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performance  in  defense  system  acquisitions  and  technology  developments. 
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pertinent  data  that  may  be  of  use  in  improving  this  standard  should  be  forwarded  to  the  following 
addressee  using  the  Standardization  Document  Improvement  Proposal  appearing  at  the  end  of  this 
document  or  by  letter: 
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1 .  Scope  of  this  Standard 


This  Standard  establishes  test  and  evaluation  requirements  related  to  the  development,  qualification  (or 
certification),  and  acceptance  (flight  production  unit)  of  liquid  propellant  rocket  engines  and  associated 
propulsion  systems.  Requirements  include  those  associated  with  integrity,  strength,  life,  interface 
conditions,  and  functional  performance.  These  requirements  should  be  understood  and  applied  early  in  the 
design  phase  to  enhance  success  in  the  development,  test,  and  evaluation  phases.  Test  generally  includes 
component  level  testing,  engine  system  level  testing,  and  vehicle  stage  integrated  propulsion  system  level 
testing.  Development  addressed  herein  is  largely  with  respect  to  how  it  increases  the  likelihood  of 
successful  qualification  and/or  provides  additional  necessary  verification  samples;  thus  development 
requirements  outside  those  applicable  to  minimum  verification  requirements  are  treated  less  rigorously  in 
general.  Evaluation  includes  relevant  and  appropriate  analyses  for  verification  of  requirements.  In  some 
cases,  requirements  are  expressed  by  reference  to  other  standards. 

1.1  Purpose 

This  Standard  establishes  the  test  and  evaluation  requirements  for  liquid  propellant  rocket  engines.  These 
requirements  shall  be  used  to  define  a  test  program,  primarily  for  qualification  and  production  acceptance, 
that  will  appropriately  verify  the  design,  identify  latent  defects,  ensure  adequate  functional  performance, 
and  help  ensure  a  high  level  of  confidence  in  achieving  successful  launch  missions.  It  is  expected  that  the 
overall  program  will  also  include  a  thorough  development  program  and  use  other  good  engineering 
practices  to  help  maximize  the  success  of  the  test  program. 

1.2  Application 

This  document  is  intended  for  compliance  in  government  acquisition  programs  when  levied  by  the 
Performance  Work  Statement  (PWS),  Statement  of  Work  (SOW),  and/or  contract,  and  are  intended  to  be 
flowed,  as  applicable,  throughout  the  supply  chain.  The  test  requirements  herein  focus  on  design 
verification,  and  the  identification  of  latent  defects  to  help  ensure  a  high  level  of  confidence  in  achieving 
successful  space  missions.  Unless  otherwise  specified  by  the  Procurement  Authority,  the  requirements 
herein  are  intended  to  apply  to  new  or  modified  liquid  rocket  engine  (LRE)  designs,  new  or  modified 
LRE  unit  designs,  use  in  a  new  application  or  environment,  and  procurement  from  new  supplier  or  a  new 
manufacturing  location.  This  Standard  applies  to  LREs  and  associated  propulsion  systems  for  expendable 
and  re-usable  applications.  It  is  expected  that  as  reusable  engine  technologies  evolve  over  time, 
adjustments  to  the  Standard  may  be  needed.  No  distinction  is  made  between  non-human -rated  and 
human-rated  systems.  Relevant  LREs  include  those  using  pump-fed  or  pressure-fed  designs,  with  various 
propellant  combinations  including  hydrogen/oxygen,  hydrocarbon/oxygen,  storable,  or  mono-propellants. 
This  Standard  addresses  development,  qualification,  acceptance,  and  pre-launch  testing  for  main 
propulsion  systems  (i.e.,  steady-state,  non-pulsing,  thrust  greater  than  4,500  N  (1,000  lbf))  for  space 
launch  vehicles  (including  booster,  upper  stage,  and  in-space  propulsion).  This  Standard  focuses  on 
testing  of  an  LRE  at  the  individual  engine  and  integrated  propulsion  system  levels,  but  includes  lower 
level  testing  where  warranted. 

The  engine  system  as  a  whole  is  generally  defined  to  encompass  those  components  from  the  engine  inlet 
flanges  to  the  thrust  chamber  nozzle,  and  includes  all  interface  connections  to  the  launch  vehicle  and 
launch  facility. 

This  Standard  is  intended  to  be  used  with  other  mission  assurance  documents,  including  SMC-S-016  [1] 
and  SMC-S-005  [2],  Within  the  nomenclature  of  SMC-S-016  [1],  an  LRE  is  categorized  as  a  subsystem. 
An  engine  system,  which  may  include  multiple  LREs,  and  the  entire  launch  vehicle  propulsion  system  are 
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also  considered  subsystems  within  the  SMC-S-016  [1]  nomenclature.  Within  the  nomenclature  of  SMC-S- 
005  [2],  an  LRE  is  categorized  as  a  pressurized  system,  meaning  there  are  pressure -containing  elements 
within  the  LRE.  This  Standard  utilizes  these  documents  and  provides  more  detailed  and  specific 
requirements  applicable  to  LREs  and  their  integration.  The  terminology  within  this  document  is  only 
intended  to  provide  clarification  of  the  appropriate  requirements,  and  not  to  supersede  the  test  category 
classifications  of  other  mission  assurance  standards. 

Within  this  Standard,  all  requirements  are  numbered  and  indicated  by  the  word  shall,  thereby 
differentiating  requirements  text  from  explanatory  or  guidance  text. 

1.3  Tailoring 

The  requirements  contained  herein  can  be  tailored  with  the  Approval  Authority  concurrence  based  on 
each  project-specific  acquisition  situation/environment,  design  complexity,  design  margins, 
vulnerabilities,  technology  state  of  the  art,  in-process  controls,  mission  characteristics/criticality,  life 
cycle  cost,  number  of  vehicles  involved,  prior  usage,  and  acceptable  risk.  All  tailoring  of  requirements 
must  achieve  the  intent  of  the  requirements  in  this  Standard  and  be  consistent  with  the  Approval 
Authority’s  risk  posture.  As  part  of  the  tailoring  process,  technical  rationale  with  supporting  data  for  each 
tailored  requirement  must  be  documented.  Tailoring  rationales  should  include  risk  assessment  per  the 
process  detailed  in  MIL-STD-882  [3].  If  the  baseline  requirements  in  this  Standard  are  not  tailored  by  the 
contract,  the  requirements  of  this  document  stand  as  written. 

Herein,  requirements  for  engines  used  on  vehicles  transporting  personnel  are  generally  intended  to  be  the 
same  as  for  engines  used  on  vehicles  transporting  hardware  only.  However,  engines  used  for  flight 
systems  transporting  personnel  may  have  additional  program-specific  verification  and/or  safety 
requirements  to  be  consistent  with  the  established  program-specific  risk  levels  for  mission  success  and 
flight  crew  safety. 
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2.  Reference  Documents 


2.1  Applicable  Documents 

The  following  documents,  of  the  issue  identified,  form  a  part  of  this  Standard  to  the  extent  specified 
herein.  The  documents  are  listed  in  order  of  occurrence  within  this  Standard.  Where  conflicts  exist 
between  the  requirements  of  other  documents  and  this  Standard,  the  requirements  of  this  Standard  take 
precedence. 

1.  SMC-S-016  Test  Requirements  for  Launch,  Upper-Stage  and  Space  Vehicles, 

Air  Force  Space  Command  Space  and  Missile  Systems  Center 
Standard,  5  September  2014. 

2.  SMC-S-005  Space  Flight  Pressurized  Systems,  Air  Force  Space  Command 

Space  and  Missile  Systems  Center  Standard,  28  February  2015. 

3.  MIL-STD-882E  System  Safety,  Department  of  Defense  Standard  Practice,  1 1  May 

2012. 

4.  CPIAC  Publication  655  Klem,  M.  D.  and  R.  S.  Fry,  Guidelines  for  Combustion  Stability 

Specifications  and  Verification  Procedures  for  Liquid  Propellant 
Rocket  Engines,  The  Johns  Flopkins  University  Chemical 
Propulsion  Information  Analysis  Center,  January  1997. 

5.  AFI  91-217  Space  Safety  and  Mishap  Prevention  Program,  Air  Force 

Instruction,  Department  of  the  Air  Force,  17  April  2014. 

6.  AIAA  S-080-1998  Space  Systems  -  Metallic  Pressure  Vessels,  Pressurized 

Structures,  and  Pressure  Components,  American  National 
Standard,  ANSI/ AIAA  S-080-1998,  13  September  1999. 

7.  AIAA  S-l  10-2005  Space  Systems  -  Structures,  Structural  Components,  and 

Structural  Assemblies,  American  Institute  of  Aeronautics  and 
Astronautics,  AIAA  S-l  10-2005,  12  July  2005. 

8.  AIAA  S-081A-2006  Space  Systems  -  Composite  Overwrapped  Pressure  Vessels 

(COPVs),  American  National  Standard,  ANSI/AIAA  S-081A- 
2006,  24  July  2006. 

9.  AIAA  S-l  13-2005  Criteria  for  Explosive  Systems  and  Devices  on  Space  and 

Launch  Vehicles,  American  Institute  of  Aeronautics  and 
Astronautics,  AIAA  S-l  13-2005,  10  November  2005. 

10.  AIAA  S-l  14-2005  Moving  Mechanical  Assemblies  for  Space  and  Launch  Vehicles, 

American  Institute  of  Aeronautics  and  Astronautics,  AIAA  S- 
114-2005,  30  June  2005. 

1 1 .  SMC-S-01 1  Parts,  Materials,  and  Processes  Con  trol  Program  for 

Expendable  Launch  Vehicles,  Air  Force  Space  Command  Space 
and  Missile  Systems  Center  Standard,  31  July  2015. 
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12.  SMC-S-004 


13.  NASA-STD-5020 


14.  ISO  Standard  10785 

2.2  Guidance  Documents 


Independent  Structural  Loads  Analysis,  Air  Force  Space 
Command  Space  and  Missile  Systems  Center  Standard,  13  June 
2008. 

Requiremen  ts  for  Threaded  Fastening  Systems  in  Spaceflight 
Hardware,  National  Aeronautics  and  Space  Administration, 

12  March  2012. 

Space  Systems  -  Bellows  -  Design  and  Operation,  International 
Organization  for  Standardization,  First  Edition  2011-10-01. 


15.  AS6500,  Manufacturing  Management  Program,  SAE  International,  2014. 

16.  AS9103,  Variation  Management  of  Key  Characteristics,  SAE  International,  2012. 

17.  JANNAF-GL-2012-01-R0,  Test  and  Evaluation  Guidelines  for  Liquid  Rocket  Engines,  Joint 
Army  Navy  NASA  Air  Force  Liquid  Propulsion  Subcommittee  Test  Practices  and  Standards 
Panel,  December  2012. 

18.  NASA-STD-5012B,  Strength  and  Life  Assessment  Requirements  for  Liquid-Fueled  Space 
Propulsion  System  Engines,  National  Aeronautics  and  Space  Administration,  June  2016. 

19.  NASA  SP-8007,  Buckling  of  Thin-Walled  Circular  Cylinders,  National  Aeronautics  and 
Space  Administration,  August  1968. 

20.  NASA-STD-5019A,  Fracture  Control  Requirements  for  Spaceflight  Hardware,  National 
Aeronautics  and  Space  Administration,  January  2016. 

2 1 .  NAS  A-STD-5009  Nondestructive  Evaluation  Requirements  for  Fracture-Critical  Metallic 
Components,  National  Aeronautics  and  Space  Administration,  2008. 

22.  M.  Singh,  J.  Vargo,  D.  Schiffer  and  J.  Dello,  “Safe  Diagram  -  A  Design  and  Reliability  Tool 
for  Turbine  Blading,”  Dresser-Rand  Company,  2002. 

23.  NASA  SP-8123,  Liquid  Rocket  Lines,  Bellows,  Flexible  Hoses,  and  Filters,  National 
Aeronautics  and  Space  Administration,  April  1977. 


Unless  otherwise  indicated,  copies  of  federal  and  military  specifications,  standards,  and  handbooks  are 
available  from  Department  of  Defense  Single  Supply  Point  at  http://quicksearch.dla.mil. 

AIAA  standards  must  be  procured  directly  from  the  owner. 
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3.  Acronyms  and  Definitions 


3.1  Acronyms 

ALF 

allowable  load  factor 

ATP 

acceptance  test  procedure 

CMP 

critical  manufacturing  process 

COPV 

composite  overwrapped  pressure  vessel 

DDT&E 

design,  development,  test,  and  evaluation 

DOP 

detailed  operating  procedure 

ECF 

environmental  correction  factor 

ELCF 

external  load  correction  factor 

EOM 

end  of  mission 

FAF 

fatigue  analysis  factor 

FID 

failure  identification 

FoS 

factor  of  safety 

ft-lbf 

foot-pound(s)  force 

GG 

gas  generator 

HCF 

high-cycle  fatigue 

Isp 

specific  impulse 

KC 

key  characteristic 

KF 

knockdown  factor 

kPa 

kilopascal(s) 

KPP 

key  process  parameters 

LCC 

launch  commit  criteria 

LCF 

low-cycle  fatigue 

LRE 

liquid  rocket  engine 

LRU 

line  replaceable  unit 
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MCC 

main  combustion  chamber 

MDC 

maximum  design  condition 

MDCL 

maximum  design  condition  load 

MEOP 

maximum  expected  operating  pressure 

MMA 

moving  mechanical  assembly 

MMPDS 

Metallic  Materials  Properties  Development  and  Standardization 

MR 

mixture  ratio 

MS 

margin  of  safety 

NAFEMS 

National  Agency  for  Finite  Element  Methods  and  Standards 

NDE 

non-destructive  examination 

NDI 

non-destructive  inspection 

NPSP 

net  positive  suction  pressure 

PB 

pre-burner 

Pc 

chamber  pressure 

PL 

power  level 

see 

start  commit  criteria 

SL 

service  life 

TLYF 

test-like-you-fly 

TPA 

turbopump  assembly 

TPS 

thermal  protection  system 

TVC 

thrust  vector  control 

Xlb 

demonstration  factor  with  respect  to  the  longest  burn 

Xsl 

demonstration  factor  with  respect  to  the  service  life 

3.2  Definitions 

The  following  definitions  of  significant  terms  are  provided  to  ensure  precision  of  meaning  and 
consistency  of  usage.  In  the  event  of  a  conflict,  the  definitions  listed  here  apply. 
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A-Basis  Allowable:  The  mechanical  strength  value  above  which  at  least  99%  of  the  population  of  values 
is  expected  to  fall,  with  a  confidence  level  of  95%. 

Acceptance  Test  (or  Acceptance  Test  Procedure,  ATP):  The  required  formal  tests  (or  procedures) 
conducted  on  the  flight  hardware  to  ascertain  that  the  materials,  manufacturing  processes,  and 
workmanship  meet  specifications  and  that  the  hardware  is  acceptable  for  intended  usage. 

Allowable  Load  Factor:  A  multiplier  to  the  Maximum  Design  Condition  Load  corresponding  to  failure. 

Ambient  Environment:  The  actual  external  environment  surrounding  an  engine  or  subsystem.  The 
environment  will  vary  depending  on  whether  operation  is  during  ground  test  or  flight  test.  Unless 
otherwise  noted,  the  reference  ambient  environment  for  a  ground  test  is  defined  as  temperature  of  23  ± 
3°C  (73  +  5°F),  atmospheric  pressure  of  101  +2/-23  kPa  (29.9  +0.6/-6.8  in  Hg),  and  relative  humidity  of 
50  ±  20%.  Actual  ground  test  ambient  environmental  conditions  should  be  documented,  particularly  when 
they  are  outside  of  this  range. 

Analysis  Validation:  Quantification  of  the  accuracy  of  analysis  results  through  comparison  to 
experimentally  measured  data,  and  subsequent  confirmation  that  the  model’s  accuracy  is  satisfactory  for 
its  intended  use. 

Analysis  Verification:  The  process  of  determining  the  correctness  of  model  input  data,  the  numerical 
accuracy  of  the  solution  obtained,  and  the  correctness  of  the  output  data  for  a  particular  simulation. 

Assembly:  Completed  functional  subsystem,  system,  engine,  vehicle,  or  other  hardware,  which  itself  is 
assembled  from  smaller  parts. 

B-Basis  Allowable:  The  mechanical  strength  value  above  which  at  least  90%  of  the  population  of  values 
is  expected  to  fall,  with  a  confidence  level  of  95%. 

Booster:  The  lowest  stage  of  a  multi-stage  launch  vehicle  that  lifts  the  vehicle  off  of  the  launch  pad  and 
injects  an  upper-stage  space  vehicle  and  satellite  into  a  trajectory  (typically  sub-orbital). 

Bootstrap:  The  portion  of  an  LRE  start  transient  where  the  engine  cycle  becomes  self-sustaining. 

Breadboard:  Representative  components  in  a  laboratory  or  facility  test  environment  that  is  representative 
of  the  functional  relationship  of  the  final  system,  but  is  not  configured  in  the  final  system  configuration  or 
with  all  of  the  components. 

Buckling  and  Crippling:  The  propensity  of  a  structure  to  collapse  under  loads  because  of  material-load 
or  geometry-induced  lateral  instability. 

Burst  Factor:  A  multiplying  factor  applied  to  the  maximum  expected  operating  pressure  (MEOP)  to 
obtain  the  design  burst  pressure.  Burst  factor  is  synonymous  with  ultimate  pressure  factor.  The  factor  is 
adjusted  to  account  for  differences  between  test  and  flight  conditions. 

Burst  Pressure:  The  minimum  pressure  level  at  which  failure  of  the  pressurized  hardware  item  occurs. 
Burst  pressure  can  be  estimated  by  analysis  and/or  measured  by  test.  The  burst  pressure  is,  by  definition, 
greater  than  or  equal  to  the  design  burst  pressure. 
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Chamber  Pressure  (Pc):  Force  per  unit  area  within  the  enclosed  chamber  between  the  injectors  and 
throat  where  combustion  takes  place.  Often  referenced  as  injector-end  Pc  (static  pressure  at  the  injector 
face),  or  nozzle  stagnation  Pc  (calculated  from  injector-end  Pc  and  Rayleigh  losses). 

Chilldown:  Process  for  a  cryogenic  engine,  prior  to  start,  that  cools  engine  components  down  to  the  cold 
temperatures  needed  to  avoid  excessive  propellant  boiling,  and  facilitate  proper  pumping  and  bootstrap. 
Typically  most  important  for  the  turbomachinery  of  cryogenic  LREs. 

Component:  A  functional  unit  or  elementary  part  of  a  system  that  is  viewed  as  an  entity  for  the  purpose 
of  analysis,  manufacturing,  maintenance,  or  recordkeeping  (e.g.,  valve,  injector,  chamber,  turbopump). 

Critical  Manufacturing  Process  (CMP):  A  process  that  creates  or  substantially  affects  a  key  or  critical 
characteristic.  (Source:  AS6500,  "Manufacturing  Management  Program,"  SAE  International  [15]) 

Damage-Tolerance  Life  (Safe-Life):  The  required  period  of  time  or  number  of  cycles  that  the  structure, 
containing  the  largest  crack  undetectable  by  the  implemented  NDI,  is  shown  by  analysis  or  testing  to 
survive  without  leaking  or  failing  catastrophically  in  the  expected  service  load  and  environment. 

Demonstrator  (or  Prototype)  Program:  Program  to  increase  confidence  in  the  likely  success  and 
provide  risk  reduction  for  proposed  new  designs,  concepts,  applications,  or  technologies  prior  to  a  full 
development  program. 

Design  Burst  Pressure:  A  pressure  that  the  pressurized  hardware  must  withstand  without  rupture  in  the 
applicable  operating  environment;  equal  to  the  product  of  the  maximum  expected  operating  pressure 
(MEOP)  and  the  burst  factor. 

Design,  Development,  Test  and  Evaluation  (DDT&E):  The  phase  of  a  program  during  which  a  new 
design  or  concept  is  initiated,  refined,  and  implemented  up  to  manufacturing  of  qualification  or  flight 
hardware.  Activities  during  this  phase  will  provide  confidence  that  the  new  design  and  concepts  will 
accomplish  mission  objectives.  See  also  development  phase. 

Design  Service  Life:  See  sendee  life. 

Detrimental  Yielding  or  Deformation:  The  structural  deformation,  deflection,  or  displacement  that 
prevents  any  portion  of  the  structure  from  performing  its  intended  function,  or  it  interferes  with  the 
intended  function  of  other  components,  or  that  reduces  the  probability  of  successful  completion  of  the 
mission. 

Development  Hardware  (or  Development  Test  Article):  Vehicle,  subsystem,  or  unit  hardware 
dedicated  to  provide  design  requirement  information.  Generally  full  scale  and  similar  to  the  flight 
hardware.  Design  changes  are  often  required  during  the  development  program  as  information  is  collected, 
but  by  the  time  the  development  program  is  completed,  the  test  articles  should  be  equivalent  or  nearly- 
equivalent  to  the  flight  hardware  in  all  aspects  of  flow-path  and  design.  Development  test  articles  are  not 
intended  for  flight. 

Development  Phase:  The  development  phase  usually  provides  the  first  true  demonstration  of  the 
capabilities  of  a  proposed  design.  Development  testing  is  used  to  identify  problems  early  in  their  design 
evolution  so  that  any  required  corrective  actions  can  be  taken  prior  to  starting  formal  qualification  testing. 

Development  Test:  Tests  conducted  on  representative  articles  to  assess  design  concepts,  characterize 
engineering  parameters,  gather  data,  and  validate  the  design  approach. 


Duty  cycle:  See  service  life. 

Engine:  See  liquid  rocket  engine. 

Engine  Cycles:  A  thermodynamic  cycle  that  describes  how  liquid  propellants  are  used  within  the  engine 
to  generate  thrust.  Common  LREs  include  pressure  fed,  expander,  gas  generator  (GG),  and  staged- 
combustion  cycles. 

Engine  System:  A  term  used  to  describe  the  liquid  rocket  engine  (LRE)  portion  of  the  integrated  stage, 
whether  it  is  a  single  engine  or  a  multi-engine  configuration. 

Environmental  Correction  Factor:  A  factor  applied  to  the  structural  test  loads  to  compensate  for 
material  strength  differences  between  test  and  flight  conditions. 

Expendable  Engine:  An  engine  that  is  discarded  after  use  on  a  single  mission. 

External  Load  Correction  Factor:  A  factor  applied  to  the  structural  test  loads  to  compensate  for 
differences  in  test  configuration  (e.g.,  loads,  boundary  conditions)  between  test  and  flight  conditions. 

Factor  of  Safety  (FoS):  A  multiplying  factor  applied  to  the  maximum  expected  operating  loads/stresses 
for  the  purposes  of  analytical  assessment  (design  factor)  and/or  test  verification  (test  factor)  of  structural 
design  adequacy.  The  FoS  is  used  to  account  for  build-to-build  hardware  variability,  uncertainty  in 
internal  load  paths  and  stress/strain  levels,  and  uncertainty  in  ultimate  failure  modes.  The  FoS  provides 
separation  between  the  statistical  distributions  for  loads  and  material  properties. 

Failure:  Rupture,  collapse,  excessive  deformation,  or  any  other  phenomenon  resulting  in  the  inability  of  a 
structure  to  sustain  specified  loads,  pressures,  and  environment;  or  the  inability  of  a  unit  to  otherwise 
function  as  designed. 

Fatigue:  The  process  of  progressive  localized  permanent  structural  change  occurring  in  a  material 
subjected  to  conditions  which  produce  fluctuating  stresses  and  strains  at  some  point  or  points,  and  which 
may  culminate  in  cracks  or  complete  fracture  after  a  sufficient  number  of  fluctuations. 

Fatigue  Analysis  Factor  (FAF):  A  factor  to  compensate  for  large  changes  in  life  that  occur  because  of 
small  changes  in  stress.  It  is  applied  to  the  limit  stress/strain  before  entering  the  stress  versus  cycles  to 
failure  (S-N)  design  curve  to  determine  the  fatigue  life. 

Flight  Design:  Final  production  design  intended  for  the  “as-flown”  hardware. 

Flight  Operational  Phase:  This  phase  begins  at  launch.  It  includes  test  flights  prior  to  the  first  mission 
and  the  actual  mission  flights  themselves.  Flight  data  generated  during  this  phase  may  be  used  to  generate 
performance  reconstructions  and  detailed  post-flight  data  reviews,  with  the  goal  of  verifying  in-flight 
specification  performance,  interface  compatibility  and  predictions  (e.g.,  engine  and  vehicle  operating 
environments),  calibration/control,  and  the  ability  to  meet  future  mission  requirements.  The  accumulation 
of  flight  data  generally  leads  to  refinement  of  flight  simulations  and  revision  of  expected  flight 
dispersions. 

Functional  Test:  A  test  performed  to  assess  the  operability  and/or  capability  of  the  item  under  test  within 
the  boundaries  established  by  design  requirements.  For  example,  the  test  screens  for  malfunctions,  failure 
to  execute,  sequence  of  action,  interruption  in  continuous  function,  or  failure  in  cause  and  response. 
Functional  tests  are  conducted  in  the  most  applicable  environment. 
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Hazard:  A  real  or  potential  condition  that  could  lead  to  an  unplanned  event  or  series  of  events  (i.e. 
mishap)  resulting  in  death,  injury,  occupational  illness,  damage  to  or  loss  of  equipment  or  property,  or 
damage  to  the  environment. 

Hot-Fire  Test:  A  test  of  the  engine  propulsion  systems  and  components  that  includes  actual  ignition  and 
combustion  of  propellants  within  the  engine,  simulating  flight  conditions  to  the  extent  possible. 

Impulse:  Integral  of  thrust  over  a  specified  time  period. 

Key  Characteristic  (KC):  The  features  of  a  material  or  part  whose  variation  has  a  significant  influence 
on  product  fit,  performance,  service  life,  or  manufacturability.  (Source:  AS9103,  "Variation  Management 
of  Key  Characteristics,”  SAE  International  [16]) 

Key  Process  Parameters  (KPP):  Attributes  of  a  manufacturing  process  that  are  considered  most  critical 
or  essential  to  control  for  a  successful  outcome. 

Line  Replaceable  Unit  (LRU):  A  unit  (e.g.,  igniter  or  closed-loop  control  valve)  that  may  be  removed 
and  replaced  by  a  separate  unit  without  requiring  engine  removal,  and  without  need  for  a  repeat  of  hot-fire 
test. 

Liquid  Rocket  Engine  (LRE):  Launch  or  space  vehicle  propulsion  subsystem  utilizing  a  combination  of 
components  and  liquid  phase  chemical  reactants  to  provide  thrust.  Generally  includes  the  nozzle,  thrust 
chamber,  pumps,  valves,  regulators,  and  plumbing.  An  engine  system  may  consist  of  one  or  more  LREs 
to  satisfy  full  stage  and  vehicle  propulsion  needs. 

Loads:  Any  condition,  such  as  pressure,  force,  moment,  thermal  environments,  acceleration,  and  moisture 
that  can  produce  a  non-zero  stress  state  in  the  structure. 

Margin:  Capability  in  excess  of  worst-case  operating  conditions. 

Margin  of  Safety  (MS):  A  metric  that  predicts  the  structural  integrity  of  an  engine  element  based  on  the 
required  factor  of  safety  (FoS)  and  the  predicted  worst-case  conditions  against  allowable  limits. 
Equivalently,  MS  expresses  the  structural  capability  with  respect  to  the  design  safety  factor. 

Maximum  Design  Condition  (MDC):  The  most  severe  environment  specified  for  the  engine  and  its 
components. 

Maximum  Design  Condition  Load  (MDCL):  This  load  condition  is  based  on  the  most  critical 
condition,  considering  all  loads  and  combinations  of  loads  and  environments  that  the  engine  and  its 
components  are  expected  to  experience,  and  that  they  must  survive  without  failure.  All  phases  in  the  life 
of  the  hardware,  including  fabrication,  assembly,  testing,  transportation,  ground  handling,  checkout, 
firing,  launch,  flight,  and  return,  are  to  be  considered  in  defining  the  MDC  load.  The  MDC  load  may  be  a 
worst-case  combination  of  loads  that  a  structure  may  experience  during  its  service  life  in  the  specified 
environments.  When  a  statistical  estimate  is  applicable,  this  load  corresponds  to  a  99%  enclosure  with  a 
90%  confidence  level. 

Maximum  Expected  Operating  Pressure  (MEOP):  The  maximum  pressure  which  the  pressurized 
hardware  is  expected  to  experience  during  its  service  life  in  association  with  its  applicable  operating 
environments  (includes  worst-case  dispersions). 
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Maximum  and  Minimum  Expected  Temperatures:  The  highest  and  lowest  temperatures  that  an  item 
can  experience  during  its  service  life,  including  all  test  and  operational  modes. 

Mixture  Ratio  (MR):  Ratio  of  the  oxidizer  mass  flow  rate  to  the  fuel  mass  flow  rate.  For  engine  MR,  this 
is  measured  at  the  engine  inlets. 

Net-Section  Failure:  A  ductile  mode  of  failure  in  which  the  net  cross  section  loses  its  capability  to 
sustain  the  mechanical  load.  The  applied  mechanical  load  is  checked  against  the  net-section  failure  load. 

Non-Destructive  Inspection  (NDI):  Methods  of  inspection  for  integrity  that  do  not  impair  serviceability, 
life,  or  performance. 

Operability:  the  ability  to  support  required  flight  rates  and  schedules  and  to  meet  a  variety  of  operational 
characteristics  while  minimizing  cost  and  risk. 

Operating  Envelope:  Outer  boundaries  of  conditions  to  which  hardware  may  be  subjected  during 
intended  operation  and  which  encompass  all  possible  intended  variations  of  a  set  of  parameters  with 
dispersions  (e.g.  thrust  and  mixture  ratio  boundaries). 

Operating  Environment:  Thermal,  pressure,  dynamic  and/or  electromagnetic  conditions  to  which  the 
system  is  exposed  during  its  operational  life. 

Operational  Life:  The  total  allowed  starts  and  run-time  including  ground  acceptance  testing,  on-pad 
firings/aborts,  and  flight  exposure. 

Part:  A  single  piece  (or  two  or  more  joined  pieces)  that  is  not  normally  subject  to  disassembly  without 
destruction  or  impairment  of  the  design  use.  Examples  are  resistors,  integrated  circuits,  relays,  and  roller 
bearings. 

Physical  Envelope:  Dimensional  boundary  which  encompasses  the  component  or  system. 

Pogo  Effect:  Self-excited,  sustained  vibration  and  deflections  (typically  associated  with  vehicle  axial 
motion)  due  to  interaction  of  structural  dynamic  modes  and  engine  thrust  oscillation. 

Powerpack:  Subsystem  test  article  which  typically  includes  turbomachinery  and  major  combustion 
devices.  It  is  intended  to  test  these  items  in  combination  as  risk  mitigation  prior  to  or  in  parallel  with  full- 
up  engine  testing. 

Prelaunch  Operational  Phase:  This  phase  begins  when  the  flight  hardware  and  software  are  received  at 
the  launch  site  and  continues  until  launch.  It  includes  all  preparatory  operations  and  checkout  testing  to 
verify  flight  readiness.  It  may  also  include  separate  flight  readiness  static  firings  and/or  autonomous 
engine  health  monitoring  and  checkout  during  the  engine  startup  and  main  stage  operation  immediately 
prior  to  lift-off.  It  is  intended  to  ensure  the  readiness  of  the  hardware,  software,  personnel  procedures,  and 
mission  interfaces  to  support  launch  and  the  program  mission.  On  some  occasions,  the  prelaunch 
operations  may  include  unexpected  or  out-of-sequence  inspection,  testing,  or  modification  of  flight 
hardware  to  resolve  identified  concerns  after  the  hardware  has  been  delivered  to  the  launch  site. 

Prelaunch  Tests:  Testing  following  system  delivery  to  vehicle  factory  or  launch  site  prior  to  launch.  This 
is  intended  to  verify  system  readiness  for  integration,  system  integrity,  safety,  and  performance. 
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Pressure  Component:  a  component  in  a  pressurized  system,  other  than  a  pressure  vessel,  pressurized 
structure,  or  special  pressurized  equipment,  that  is  designed  largely  by  the  internal  pressure.  Examples 
include  lines,  fittings,  valves,  and  bellows  with  no  significant  external  load. 

Pressure-Loaded  Component/S trueture:  A  component/structure  not  intended  to  store  a  fluid  under 
pressure  but  experiencing  a  combination  of  internal  pressure  and  external  loading.  The  pressure-loaded 
component/structure  is  generally  considered  to  be  part  of  the  engine.  Examples  include  pump  housings, 
main  propellant  lines/valves,  and  combustion  chambers. 

Pressure  Vessel:  A  container  designed  primarily  for  the  storage  of  pressurized  fluids,  and  which 

1 .  contains  stored  energy  of  19,307  joules  (14,240  ft-lbf)  or  greater,  based  on  adiabatic  expansion  of 
a  perfect  gas;  or 

2.  contains  gas  or  liquid  which  will  create  a  mishap  (accident)  if  released;  or 

3.  will  experience  a  MEOP  greater  than  700  kPa  (100  psi). 

Pressurized  System:  A  system  that  consists  of  pressure  vessels,  or  pressurized  structures,  or  both,  and 
other  pressure  components  such  as  lines,  fittings,  valves,  and  bellows  that  are  exposed  to  and  structurally 
designed  largely  by  the  acting  pressure.  Not  included  are  electrical  or  other  control  devices  required  for 
system  operation.  A  pressurized  system  is  defined  as  a  system  on  the  engine  that  stores  and/or  supplies 
pressurized  hydraulic/pneumatic/purge  fluid  or  gas  for  the  actuation  of  engine  system  components  or 
other  system  functions.  The  usage  is  consistent  with  that  used  in  SMC-S-005  [2], 

Proof  Factor:  A  multiplying  factor  applied  to  the  maximum  design  condition  load  or  MEOP  to  obtain  the 
proof  load  or  proof  pressure  for  use  in  a  proof  test.  The  proof  factor  is  adjusted  using  an  environmental 
correction  factor  and  external  correction  factor  to  account  for  differences  between  test  and  flight 
conditions. 

Proof  Load:  Value  established  by  taking  the  calculated  maximum  design  condition  (e.g.,  MEOP)  and 
multiplying  it  by  the  proof  factor. 

Proof  Pressure:  Pressure  equal  to  the  product  of  the  MEOP  and  the  proof  factor,  where  the  proof  factor 
has  been  adjusted  for  differences  between  test  and  flight  conditions.  Test  pressure  used  to  give  evidence 
of  satisfactory  workmanship  and  material  quality  and/or  establish  maximum  initial  flaw  sizes  for  damage- 
tolerance  life  (safe -life)  demonstration.  Synonymous  with  proof  load. 

Proof  Test:  A  static  load  or  pressure  test  performed  as  an  acceptance  workmanship  screen  to  prove  the 
structural  integrity  of  a  unit  or  assembly.  Gives  evidence  of  satisfactory  workmanship  and  material 
quality  by  the  absence  of  failure  or  detrimental  deformation.  The  proof  test  load  and/or  pressure 
compensates  for  the  difference  between  test  and  flight  conditions,  if  applicable. 

Propulsion  System:  The  system  producing  thrust,  which  includes  the  engine  system;  propellant  tankage 
and  feedlines;  off-engine  valve,  fill,  vent,  purge,  chilldown  and  drain  systems;  pogo  suppression  devices; 
and  propellant  tank  pressurization  systems,  as  applicable.  A  propulsion  subsystem  within  SMC-S-016  [1] 
is  termed  a  propulsion  system  within  this  document. 

Prototype:  First  example  build  of  a  preliminary  design  under  consideration  for  production.  Intended  to  be 
as  representative  of  the  definitive  article  as  possible,  but  often  deficient  in  various  respects.  Many  times 
the  prototype  will  be  focused  on  replicating  only  specific  parameters  of  key  interest  since  its  purpose  is  to 
guide  future  development,  permit  customer  evaluation,  and  demonstrate  critical  new  technologies. 
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Prototype  Phase:  This  phase  precedes  development  and  may  also  be  referred  to  as  feasibility,  risk 
reduction,  or  demonstration  testing.  Tests  in  this  phase  are  intended  to  assist  design  definition  by 
providing  engineering  data  to  confirm  analyses  and/or  help  define  expected  operating  conditions.  Often 
this  testing  includes  Research  &  Development  to  explore  and/or  validate  new  technologies  that  might  be 
beneficial  to  the  engine  system.  Prototype  hardware  is  typically  designed  to  be  more  robust  with  greater 
margins  compared  to  flight  hardware  because  the  design  and  operating  conditions  have  higher  uncertainty 
during  this  phase.  The  hardware  may  contain  facility  components  in  place  of  flight  components,  modified 
components  from  earlier  engine  models,  or  component  simulators  to  gain  the  engineering  information 
needed  to  complete  the  initial  flight  design.  Breadboard  and/or  bench-level  type  engines  or  subsystems 
may  be  used  in  some  cases,  and  subscale  testing  is  also  common. 

Qualification  Hardware:  Production  articles  that  go  through  a  series  of  qualification  tests  to  demonstrate 
readiness  for  flight  operation.  Qualification  hardware  is  to  be  produced  from  the  same  drawings,  using  the 
same  materials,  tooling,  manufacturing  processes,  and  level  of  personnel  competency  as  will  be  used  for 
actual  flight  hardware.  Often  the  qualification  engines  are  the  first  engines  off  of  the  production  line. 

Qualification  Phase:  The  qualification  phase  includes  the  production  and  testing  providing  the  formal 
verification  that  the  final  design,  manufacturing  processes  and  facilities,  and  acceptance  program  produce 
flight  hardware/software  that  meet  specification  and  performance  requirements  with  adequate  margin  to 
accommodate  variations  in  hardware  and  engine  operation.  It  generally  follows  completion  of  the 
development  test  program.  The  phase  includes  validation  of  test  techniques,  procedures,  equipment, 
instrumentation,  and  software,  as  well  as  potential  rework  and  repeat  test  cycles. 

Qualification  Test:  The  required  formal  tests  (typically  to  satisfy  contractual  requirements)  intended  to 
demonstrate  that  the  final  design,  manufacturing,  assembly,  and  acceptance  testing  yield  hardware 
designs  conforming  to  specification  requirements.  Qualification  testing  verifies  compliance  to  engine 
specification  requirements  and  vehicle  interface  requirements  over  the  range  of  expected  operating 
conditions,  including  worst-case  conditions  for  all  intended  applications.  Required  margin  conditions 
(e.g.,  operating  life  margin,  thrust  margin)  are  also  verified. 

Quasi-Static  Load:  A  time-varying  load  in  which  the  duration,  direction,  and  magnitude  are  significant, 
but  the  rate  of  change  in  direction  or  magnitude,  and  the  dynamic  response  of  the  structure,  are  not 
significant. 

Restart:  Engine  start  after  previous  shutdown,  without  interruption  of  the  environment,  or  modification 
of  the  hardware  or  setup. 

Reusable  Engine:  An  engine  that  is  to  be  used  for  multiple  space  launch  missions.  The  service  life  of  a 
reusable  engine  includes  all  testing,  initial  use  and  reuses  (mission  operation  times),  refurbishment,  and 
retesting. 

Reusable  Item:  A  unit,  subsystem,  or  vehicle  that  is  to  be  used  for  multiple  missions.  The  service  life  of 
reusable  hardware  includes  all  testing,  initial  use  and  reuses  (mission  operation  times),  refurbishment,  and 
retesting. 

Reuse:  Recovery  and  use  of  an  engine  for  another  space  launch  mission  after  completion  of  a  prior  space 
launch  mission. 

S-Basis  Allowable:  The  mechanical  material  strength  value  which  represents  the  minimum  specified  by 
the  governing  industry  specification,  or  federal  or  military  standard,  or  a  specified  contractor  quality- 
control  requirement. 
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Safe  Life:  See  Damage-Tolerance  Life  ( Safe-Life ) 

Safety  Factor:  See  factor  of  safety. 

Service  Life  (SL):  The  SL  of  an  item  starts  at  the  completion  of  fabrication  and  continues  through  all 
acceptance  testing,  handling,  storage,  transportation,  prelaunch  testing,  all  phases  of  launch,  orbital 
operations,  disposal,  re-entry  or  recovery  from  orbit,  refurbishment,  retesting,  and  reuse  that  may  be 
required  or  specified. 

Service  Life  Factor:  A  multiplying  factor  to  be  applied  to  service  life  to  assess  design  adequacy  in 
fatigue  or  creep. 

Similarity:  The  process  of  assessing  by  review  of  prior  data,  hardware  configuration,  and  applications 
that  the  article  is  similar  or  identical  in  design  and  manufacturing  process  to  another  article  that  has  been 
previously  qualified  to  equivalent  or  more  stringent  specifications. 

Specific  Impulse  (Isp):  Engine  Isp  is  the  instantaneous  total  thrust  divided  by  the  instantaneous  total 
mass  flow  rate  of  propellants  through  the  engine  inlet,  at  a  specific  altitude  (e.g.,  sea  level  and/or  vacuum 
conditions). 

Steady  State:  Operation  during  which  key  engine  performance  parameters  are  no  longer  varying 
significantly  over  time  or  are  slowly  changing  at  a  constant  rate. 

Storage  Life:  The  time  that  a  unit  can  be  stored  after  acceptance  tests,  without  replacement  of  parts,  and 
subsequently  operate  successfully  and  within  specification  limits. 

Structural  Integrity:  The  ability  of  the  structure  to  meet  the  structural  requirements. 

Subassembly:  An  item  containing  two  or  more  parts,  which  is  capable  of  disassembly  or  part 
replacement. 

Test-Like- You-FIy  (TLYF):  The  general  test  philosophy  that  all  testing  should  be  representative  of  flight 
conditions  and  flight  operation  to  the  maximum  extent  possible.  Analogous  to  the  “fly-like-you-test” 
philosophy. 

Ultimate  Load  (Design):  The  load  that  the  structure  must  withstand  without  rupture  or  collapse  in  the 
expected  operating  environments.  Equal  to  the  product  of  the  maximum  design  condition  load  and  the 
ultimate  design  FoS. 

Ultimate  Pressure  Factor:  See  burst  factor . 

Ultimate  Strength:  Corresponds  to  the  maximum  load  or  stress  that  a  structure  or  material  can  withstand 
without  incurring  rupture,  collapse,  or  cracking. 

Unit:  A  functional  item  (hardware  and,  if  applicable,  software)  that  is  viewed  as  a  complete  and  separate 
entity  for  purposes  of  manufacturing,  maintenance,  and  record  keeping. 

Upper-Stage  Vehicle:  An  upper-stage  vehicle  is  one  or  more  stages  of  a  flight  vehicle  capable  of 
injecting  a  space  vehicle  or  vehicles  into  orbit  from  the  sub  orbital  trajectory. 

Validation:  To  show  to  be  accurate  and  correct  (as  in,  validate  requirements  or  validate  results). 
Validation  can  be  by  inspection,  demonstration,  or  analysis. 
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Verification:  Confirmation  that  ground  and  flight  hardware  and  software  are  in  compliance  with  design 
and  performance  requirements  (as  in,  verify  capability).  Verification  can  be  done  by  inspection,  test,  or 
analysis. 

Verification  Engine:  A  unique  engine  sample  that  is  of  the  flight  design,  or  structurally  and  functionally 
equivalent  to  the  flight  design.  It  is  suitable  as  one  of  the  required  engine  test  samples  (including  all 
qualification  engines  and  appropriate  development  engines). 

Yield  Strength:  The  load  or  stress  that  a  structure  or  material  can  withstand  without  incurring  permanent 
deformation.  (The  0.2-percent  offset  method  is  usually  used  to  determine  the  load/stress.) 
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4.  General  Requirements 


The  primary  objective  of  any  test  program  is  to  maximize  the  probability,  within  programmatic 
constraints,  that  the  flight  design  will  function  properly  and  successfully  when  used  in  actual  service  for 
the  intended  application.  Flight  risks  are  mitigated  via  prudent  and  effective  analysis  and  testing.  While 
analysis  can  sometimes  be  used  in  place  of  test,  proper  analytical  techniques  utilize  test  data  as  the  basis 
for  model  correlations.  The  combination  of  analysis  and  test  verification  is  used  for  both  qualification  of 
the  LRE  design  as  well  as  workmanship  verification  of  each  LRE  flight  unit. 

4.1  General  Test  Philosophy 

Certain  key  tenets  of  testing  have  served  the  liquid  propulsion  test  community  well  as  it  has  tried  to 
accomplish  that  objective.  One  particular  “hied  and  true”  philosophy  is  the  “Test-Like -You-Fly”  (TLYF) 
approach.  TLYF  means  that  testing  should  demonstrate  engine  operation  with  flight-representative 
hardware  and  under  flight-representative  conditions,  including  expected  worst-case  conditions.  The 
overall  test  program  should  encompass  and  explore  as  much  of  the  operational  flight  envelope  as  possible 
on  the  flight  design  to  accomplish  the  ideal  objective  to  avoid  operating  any  particular  flight  hardware 
configuration  under  any  particular  set  of  conditions  for  the  first  time  in  flight.  Some  flight  environments 
(e.g.,  acceleration)  cannot  be  replicated  during  ground  test.  Margin  testing  with  respect  to  the  expected 
flight  conditions  should  be  included  to  protect  against  known  and  unknown  uncertainties  in  the  flight 
conditions  (e.g.,  ground-to-flight  dispersions),  as  well  as  known,  anticipated,  and  unknown  hardware 
variations  (e.g.,  manufacturing  tolerances,  non-conformances,  and  undetected  deficiencies).  If  it  is 
impractical  to  test  or  simulate  a  particular  flight  condition  on  the  ground,  then  additional  margin  may  be 
appropriate.  Furthermore,  testing  should  consider  and  account  for  engine  hardware  experience  and 
exposure  throughout  all  phases  of  the  required  life  cycle,  including  manufacturing,  acceptance  testing, 
transportation,  handling,  storage,  vehicle  integration,  checkout  testing,  launch  preparations,  aborts,  liftoff, 
and  flight.  Exceptions  to  this  approach  should  be  carefully  evaluated  and  include  a  risk  determination.  It 
is  prudent  that  LREs  be  deliberately  designed  to  provide  margins  equal  to  or  greater  than  the  specified 
margin  test  requirements  so  as  to  provide  high  probability  for  test  success  and  high  reliability  for  flight 
operations. 

A  corollary  to  TLYF  is  the  “fly-as-you-test”  approach.  “Fly-as-you-test”  means  that  flight  operation 
should  remain  within  demonstrated  ground-tested  and  qualified  regimes,  and  that  design  and  process 
differences  between  qualified  test  hardware  and  flight  hardware  should  be  minimized  and  ideally  avoided. 
A  successful  development  and  qualification  program  will  anticipate  all  potential  flight  conditions  and 
ensure  those  conditions  are  validated  by  a  robust  test  program.  If  an  engine  has  multiple  applications, 
ideally  the  engine  should  be  developed  and  qualified  to  the  most  demanding  requirements,  however 
programmatic  considerations  may  dictate  a  phased  approach. 

Hot-fire  testing  to  verify  that  an  LRE  design  is  ready  for  flight  typically  consists  of  four  phases  of  major 
program  activity:  prototype  testing,  development  testing,  qualification  testing,  and  integrated  system 
testing.  The  first  three  test  phases  typically  occur  at  the  component  level  as  well  as  the  engine  level.  The 
integrated  system  testing  phase  is  performed  at  the  propulsion  system  and/or  vehicle  level.  After  an  LRE 
design  has  completed  the  qualification  program  (i.e.,  production  phase),  each  individual  flight  engine  is 
acceptance  tested  by  hot-fire  to  verify  that  specific  engine’s  suitability  for  flight.  Prelaunch  operational 
testing  is  performed  prior  to  engine  start  and  liftoff  to  verify  readiness  for  launch.  Finally,  additional 
testing  can  be  performed  or  additional  data  obtained  for  the  system  during  the  operational  phase  of  a  test 
flight  or  actual  space  launch  mission. 
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Specific  requirements  are  placed  upon  qualification,  production  unit  acceptance  testing,  and  integrated 
system  testing.  There  is  an  allowance,  and  in  fact  an  expectation,  that  engines  not  meeting  the  full 
requirements  of  qualification  will  be  used  as  a  part  of  the  overall  design  verification  effort  in  order  to 
increase  the  sample  size  of  suitable  engines.  "Verification  engines"  include  qualification  engines,  and 
may  also  include  development  engines  that  are  structurally  and  functionally  equivalent  to  the  qualification 
and  flight  design.  Hereafter,  references  to  the  qualification  requirements  are  meant  to  include  testing  on 
formal  qualification  engines  as  well  as  development  engines  that  are  suitable  as  verification  engines. 
Prototype  and  earlier  development  tests  are  not  specifically  required  herein,  but  these  tests  are  expected 
and  it  is  strongly  recommended  that  qualification  testing  be  preceded  by  a  significant  number  of 
development  engine  samples,  and  associated  testing,  to  increase  the  likelihood  of  success  in  the 
qualification  phase. 

4.2  Verification  Approach 

There  are  four  critical  aspects  of  an  LRE  test  program  related  to  verification  and  qualification  of  the 
design  and  build:  (1)  the  total  number  of  verification  engine  samples  (including  qualification  engine 
samples),  (2)  the  number  and  duration  of  tests  on  each  verification  engine,  (3)  the  specific  test  and  safety 
factors  used  in  test  and  analysis  margin  assessments,  and  (4)  the  degree  of  reliance  on,  and  maturity  of, 
analysis.  The  specifics  of  each  of  these  elements  are  discussed  in  the  following  sections.  Table  4-1  lists 
the  parameters  and  required  conditions  yielding  baseline  risk  for  a  typical  LRE  utilizing  turbomachinery. 
Requirements  for  other  LRE  configurations  will  be  noted  if  they  are  different.  Tailoring  of  Table  4-1  must 
balance  engine  complexity  with  the  program  risk  posture,  to  fit  within  cost  and  schedule  constraints. 
Further  guidance  on  tailoring  of  requirements  (including  Table  4-1)  is  contained  in  Appendix  A. 

[4.2-1]  An  LRE  test  plan  shall  be  developed  to  satisfy  the  requirements  of  this  Standard,  balancing  the 
program  technical,  schedule,  and  cost  constraints,  and  with  concurrence  of  the  Approval 
Authority. 

Table  4-1.  LRE  Verification  Engine  Samples  and  Margins/Demonstration  Factors 


Parameter 

Section 

Samples/Factors 

Unit  &  Subscale  Test  and  Evaluation 

Fatigue  and  Damage  Tolerance  Factor 

6.11 

4Xsl 

Unit  Single  Burn  Operation  Demonstration  Factor2 

6.13.2 

1.1  Xlb 

LRE  Test  and  Evaluation 

Minimum  Verification  Engine  Samples 

4.3.1 

4  engines3 

Minimum  Qualification  Engine  Samples 

4.3.1 

2  engines 

Thrust /MR  Margin1  Demonstration 

7.2.6 

2% 

Life  Demonstration  Factors  (duration  and  starts) 

7.7.1, 7.7.4 

4  engines3: 

4Xsl  on  1 ,  and  2Xsl  on  3 

Single  Burn  Endurance  Demonstration  Factor2 

7.7.2 

1.1  Xlb 

Nozzle  Operational  Demonstration  Factor 

7.7.3 

1  .2Xsl  on  4  samples 
(ablative) 

1 . 1  Xsl  on  4  samples  (non¬ 
ablative) 

1  Margin  values  consistent  with  heritage  and  experience. 

2  Applied  to  the  maximum  expected  single  burn  duration  in  flight. 

3  Includes  the  2  qualification  engine  samples. 
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4.3  Engine  Samples 


Few  aspects  of  a  development  and  qualification  program  have  as  great  an  impact  on  its  scope,  cost,  and 
schedule  as  the  number  of  engine  samples,  and  number  of  tests  to  be  incorporated  into  that  test  program 
(see  JANNAF-GL-2012-01-R0  [17]).  Cost  will  also  be  affected  across  engine  designs  by  differences  in 
engine  cycle,  physical  size,  flowrates,  and  pressures. 

The  complexity  of  a  rocket  engine  design  results  in  sensitivities  to  hardware  dimensional  variances  from 
engine -to-engine,  which  drives  the  requirement  for  multiple  engine  samples.  Despite  the  careful  attention 
paid  to  identifying  and  controlling  critical  tolerances  in  the  design  phase,  engine  testing  will  often  identify 
significant  engine-to-engine  variations  in  operating  conditions  and  other  responses.  Common  examples 
include  pump  cavitation  characteristics,  turbine  blade  responses  to  forcing  functions,  bearing  loading, 
pump  chill-down  characteristics,  ignition  effectiveness,  and  self-induced  vibration.  Adverse  responses  to 
variations  can  cause  lower  margins  than  desired.  Therefore,  one  key  objective  of  the  test  program  is  to 
provide  insight  into  engine-to-engine  variations,  and  to  verify  that  these  variations  are  acceptable  for  the 
given  design,  and  within  the  intended  application(s).  Multiple  engine  samples  demonstrating  a  test 
objective  are  required  to  provide  adequate  confidence  that  the  engine  operation  and  its  variations  are  well 
understood.  A  significant  number  of  development  engines  should  be  included  into  the  program  to  refine 
and  reduce  risk  for  the  final  flight  design.  The  optimum  number  will  depend  on  design  complexity, 
heritage,  and  risk  tolerance.  Some  verification  test  objectives  can  be  satisfied  by  the  earlier  development 
effort  (e.g.,  combustion  stability  bomb  tests),  provided  that  the  development  design  is  sufficiently  similar 
to  the  final  flight  design,  for  the  specific  test  objectives  being  accomplished.  Based  upon  engineering 
assessment,  some  of  the  development  test  effort  can  also  provide  additional  test  samples  to  support 
verification  and  add  confidence.  It  is  acceptable  to  use  some  rebuilt  engines  to  reduce  costs,  but  at  the 
disadvantage  of  reducing  the  extent  of  normal  variation  that  will  be  observed  and  characterized.  If  an 
engine  includes  reused  parts,  determination  of  whether  that  engine  sample  is  “unique”  depends  on  a  valid 
engineering  assessment  based  on  knowledge  of  the  engine  build  history  and  the  specific  objective  under 
consideration.  For  example,  an  ignition  test  sample  would  be  unique  if  the  igniter  and  injector  were 
changed  during  an  engine  rebuild,  but  for  a  pump  chill-down  test  sample,  the  uniqueness  of  the 
turbopump  unit  would  be  of  interest.  Furthermore,  any  major  hardware  changes  (e.g.,  to  resolve  a  failure 
or  to  incorporate  a  desired  improvement)  may  reset  the  test  engine  sample  count,  depending  on  the 
specific  design  features  as  they  relate  to  given  test  objectives.  Even  small  hardware  changes  must  be 
considered  carefully,  as  there  are  numerous  examples  where  seemingly  trivial  changes  have  had 
significant  unintentional  consequences. 

One  or  more  engine  samples  (new  or  reused  from  engine  level  testing)  should  undergo  additional  testing 
at  the  integrated  system  level. 

4.3.1  Number  of  Verification  Engine  Samples 

The  test  engine  sample  size  must  be  large  enough  to  characterize  impacts  of  build-to-build  variation  to  a 
high  level  of  confidence.  The  required  sample  sizes  are  based  upon  experience,  Weibull  statistical 
analysis,  and  other  reliability  calculations,  and  have  been  successfully  employed  on  past  programs.  Each 
verification  engine  may  be  associated  with  different  test  objectives,  thus  introducing  some  leeway 
regarding  specific  hardware  configuration.  Further  guidance  on  the  basis  of  the  number  of  engines,  and 
rationale  that  may  be  used  during  tailoring,  is  provided  in  Appendix  A. 

[4.3.1 -1]  The  qualification  activity  shall  use  a  minimum  number  of  unique  engine  samples  that  are  of  the 
flight  design,  or  are  structurally  and  functionally  equivalent  to  the  flight  design  (i.e.,  verification 
engines)  as  specified  in  Table  4-1.  Different  test  objectives  may  use  different  engines  to  satisfy 
this  sample  requirement. 
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[4. 3. 1-2]  The  minimum  number  of  qualification  engine  samples  shall  be  as  specified  in  Table  4-1. 

Qualification  engine  samples  are  included  in  the  total  count  of  verification  engine  samples. 

[4.3. 1-3]  All  engines  used  for  verification  activity  shall  include  the  same  instrumentation  (i.e.,  type, 
location,  sample  rate)  as  planned  for  the  qualification  engines.  Additional  instrumentation  is 
allowed. 

[4. 3. 1-4]  Each  engine  utilized  to  satisfy  the  total  engine  sample  number  (Table  4-1)  shall  successfully 
complete  testing,  including  hot-fire  tests,  encompassing  and  formally  verifying  required 
functional  requirements,  including  propellant  condition  and  interface  conditions,  representative 
operating  duty  cycles,  and  performance  (consistent  with  Table  4-2).  If  testing  on  an  engine 
sample  is  not  completed,  the  Approval  Authority  will  judge  engine  sample  acceptability  as  a 
function  of  desired  objectives,  and  based  upon  a  risk  assessment  of  what  testing  was  missed. 

[4. 3. 1-5]  Engine  activities  which  result  in  failures  or  anomalies  requiring  modification  of  the  engine 

design  shall  not  be  considered  as  part  of  the  number  of  engine  samples  specified  in  Table  4-1, 
although  credit  for  specific  objectives  may  be  granted  by  the  Approval  Authority  based  upon  high 
confidence  engineering  analysis  showing  independence  from  the  cause  of  the  failure/anomaly  and 
the  subsequent  engine  modification. 

Repair  and  rework  performed  during  engine  qualification  testing  should  be  thoroughly  evaluated,  as  these 
modifications  may  (and  typically  do)  invalidate  life  demonstration.  Specific  objectives  of  the  testing  will 
be  detailed  in  later  sections. 

It  is  recommended  that  an  earlier  development  phase  include  additional  engine  samples  beyond  the 
requirements  of  Table  4-1.  Development  engines  typically  will  have  additional  instrumentation,  and  be 
tested  to  additional  margin.  Multiple  additional  engines  are  commonly  necessary  for  a  new  engine  design 
to  effectively  evolve  the  initial  design  to  the  final  flight  design.  There  are  no  requirements  herein  for  these 
additional  engines,  but,  the  expected  total  number  of  development  engine  samples  is  expected  to  be  that 
necessary  to  facilitate  successful  verification  tests  as  defined  by  subsequent  sections,  and  considering  that: 

a.  The  requirements  of  tests  such  as  transient  (power  level  transitions)  development,  margin 
demonstration,  MR  and  inlet  box  exploration,  may  consume  the  useable  life  /  cycles  of  initial 
development  engines  more  rapidly  than  later  testing. 

b.  Early  failures  will  probably  occur. 

c.  A  major  design  iteration  may  be  required. 

d.  A  catastrophic  failure  could  occur. 

e.  Contingency  engines  should  be  available  to  continue  testing  in  the  event  of  a  problem  with  a 
particular  engine  /  test  series. 

4.4  Number  of  Total  Tests 

It  is  difficult  to  determine  the  number  of  tests  needed  to  sufficiently  verify  all  the  requirements. 
Experience,  analytical  capabilities,  and  deviation  from  known,  highly  matured  technologies/practices  all 
play  a  role.  Furthermore,  there  will  be  programmatic  influences  that  significantly  shape  the  test  campaign. 
Depending  upon  these  influences,  there  can  be  a  number  of  paths  available  to  obtain  the  necessary  data  to 
verify  and  qualify  the  design.  Largely,  the  development  path  will  have  to  deal  with  interdependencies  of 
components,  sub-systems,  and  system  (i.e.,  system  interactions).  Test  campaigns  should  be  optimized  to 
accomplish  as  many  objectives  as  possible  on  a  given  test,  without  making  the  tests  overly  complex,  and 
without  allowing  one  objective  to  interfere  with  implementation/verification  of  another. 
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[4.4-1]  The  test  program  shall  include  a  sufficient  number  of  tests,  and  on  a  sufficient  number  of  unique 
engine  samples  as  detailed  in  Table  4-2,  to  verify  all  the  specific  engine  system  performance 
requirements  and  functional  objectives.  Testing  multiple  objectives  on  any  single  test  is  allowed, 
provided  each  objective  does  not  interfere  with  verification  of  the  others. 

Table  4-2.  LRE  Verification  Engine  Objectives  and  Minimum  Unique  Engines  Samples  Required  for  Each 


Objective 

Section 

Min  Number  of  Unique 
Verification  Engine 
Samples 

Performance 

7.2 

Steady  State  Performance  Characterization 

7.2.1 

4 

Repeatability 

7.2.2 

3 

Run-Time  Trends 

7.2.3 

3 

Steady  State  Analytical  Models 

7.2.4 

4 

Thrust  and  Mixture  Ratio  Excursion  Tests 

7.2.5 

2 

Thrust  and  Mixture  Ratio  Margin  Demonstration 

7.2.6 

1 

Ignition  System 

7.2.7 

3 

Turbomachinery 

7.2.8 

4 

Combustion  Devices  and  Stability 

7.2.9 

2* 

Contamination  and  Debris  Tolerance 

7.2.10 

4 

Functional  Characteristics 

7.3 

Cold  Shock  Tests 

7.3.1 

4 

Cold  Flow  Tests 

7.3.2 

0 

Acceptance  Propellant  Conditions 

7.3.3 

4 

Engine  Propellant  Inlet  Conditions 

7.3.4 

4 

Transient  Characterization 

7.3.5 

Start  Transients 

7.3.5. 1 

4 

Restart  Transients 

7. 3. 5. 2 

4 

Throttle  Transients 

7. 3. 5. 3 

4 

Shutdown  Transients 

7. 3. 5. 4 

4 

Abort  Shutdown  Transients 

7. 3. 5. 5 

1 

NPSP  Margin  and  Cavitation 

7.3.6 

2 

Pogo  and  Pump  Compliance  Characterization 

7.3.7 

4 

Ancillary  Systems 

7.3.8 

2 

Thrust  Vector,  Gimballing,  and  Deployment 

7.3.9 

2** 

Structural  Tests 

7.4 

i 

Pressure  and  Leak  Testing 

7.5 

4 

Environments 

7.6 

Thermal  Environment 

7.6.1 

4 

Climatic  Tests 

7.6.2 

0 

Vibration,  Shock,  and  Acoustics 

7.6.3 

1 

Vehicle  Interface  Loads 

7.6.4 

4 

Electromagnetic  Compatibility  Tests 

7.6.5 

1 

Life 

7.7 

Operational  Lifetime  and  Durability 

7.7.1 

4 
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Single  Burn  Endurance  Test 

7.7.2 

1 

Nozzle  Endurance 

7.7.3 

4 

Life  Starts 

7.7.4 

4 

Acceptance  Test  Procedure  Validation 

7.7.5 

4 

Controls 

7.8 

4 

Operations 

7.9 

Pre-Test  Inspections  and  Checkouts 

7.9.1 

2** 

Post-Test  Inspections 

7.9.2 

2** 

Drying  and  Heated  Purges 

7.9.3 

4 

Gas  Liquefaction  Control 

7.9.4 

2 

External  Icing 

7.9.5 

4 

LRU  Demonstrations 

7.9.6 

1 

Reusability 

7.9.7 

4 

Operability 

7.9.8 

4 

Preflight  Procedures  and  Flight  Sequences 

7.9.9 

2** 

*  1  or  2  engines,  depending  on  the  approach  in  CPIAC  Publication  655  [4]  taken. 

**  These  should  be  performed  on  the  2  qualification  engines. 

Note:  where  0  engine  samples  are  required,  demonstration  should  be  pursued  during 
development  and/or  via  analytical  validation. 


Prior  test  programs  indicate  the  not-surprising-characteristic  that  more  test  failures  or  problems  occur 
early  in  the  test  campaign  rather  than  later  (see  Figure  4-1).  This  trend  has  continued  into  more  recent  test 
programs  (JANNAF-GL-2012-01-R0  [17]).  The  fact  that  several  recent  programs  have  utilized  a  lower 
total  number  of  tests  compared  to  the  predecessor  programs  without  increasing  flight  failure  instances 
suggests  that  a  learning  curve  exists  on  the  key  factors  which  play  a  role  in  understanding  the  physical 
system  and  its  interactions.  Some  of  the  benefits  more  recent  programs  have  over  the  predecessors  can  be 
attributed  to  the  increased  analytical  capability  and  experience  base.  The  complexity  of  Space  Shuttle 
Main  Engine  (SSME)  and  the  long  lasting  ground  test  programs  have  allowed  modeling  of  physical 
systems  to  evolve  significantly  as  has  computing  power.  Cost-driven  aspects,  however,  have  limited 
technology  development,  which  provides  an  impetus  for  additional  development  tests. 
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%  Completion  of  Qualification  Tests 

Figure  4-1.  Percentage  of  failures  encountered  as  a  function  of  qualification  test  program  completion 
for  the  F-l,  J-2,  and  SSME  programs  (JANNAF-GL-2012-01-R0  [17]). 

Since  problems  occur  which  affect  schedule  and  engine  sample  applicability  within  the  development  and 
qualification  activity,  it  is  recommended  that  the  qualification  portion  of  the  test  program  not  be  initiated 
until  the  later  portion  of  the  total  test  program.  There  tends  to  be  efforts  to  reduce  test  program  duration 
by  running  engines  in  parallel  on  multiple  facilities.  This  is  viable,  but  a  good  rule  is  to  maintain  that  a 
development  test  program  should  be  through  at  least  80%  of  its  tests  prior  to  commencement  of  the 
qualification  phase.  The  intent  is  to  mitigate  potential  impacts,  and  this  would  logically  be  at  the  latter 
portion  of  the  program  where  there  has  been  sufficient  time  to  explore  each  of  the  functional  requirements 
and  incorporate  necessary  design  changes  or  operational  refinements. 

Continuing  the  focus  on  test  planning,  there  are  multiple  potential  approaches  which  can  be  used  to 
establish  the  total  numbers  of  tests.  It  is  recommended  to  follow  a  “functional  objectives-based” 
approach.  Whichever  technique  is  used,  the  Approval  Authority  must  carefully  weigh  programmatic 
requirements  and  constraints  versus  acceptable  risk  levels  as  each  program  has  different  amounts  of 
technology  development  and  design  heritage  to  consider.  Engine  level  test  counts  should  be  discussed  in 
the  context  of  a  full  engine  development  plan,  which  is  expected  to  address  the  component,  subsystem, 
and  engine  level  test  and  evaluation  approach,  in  concert  with  modeling  and  simulation  capabilities. 

4.4.1  Functional  Objectives-Based  Approach 

The  goal  of  the  functional  objectives-based  approach  is  to  verify  all  the  specific  engine  system 
performance  requirements  and  functional  objectives  as  efficiently  as  possible  in  the  minimum  number  of 
tests.  Enough  tests  should  be  performed,  however,  to  adequately  exercise  the  full  range  of  engine 
operating  conditions,  including  nominal,  off-nominal,  and  extreme  conditions  (with  margin  where 
practical).  Furthermore,  it  is  recommended  that  enough  tests  be  performed  for  each  of  the  various 
conditions  to  adequately  characterize  the  normal  variability  of  the  engine  system  for  those  conditions. 
Since  this  approach  generally  will  not  include  sufficient  test  samples  to  statistically  demonstrate 
reliability  requirements  against  random  failure  modes  and  perhaps  not  against  wear-out  failure  modes,  it 
is  necessary  to  verify  significant  margin  against  various  key  engine  performance  aspects,  requirements, 
and  operating  conditions  to  ensure  adequate  robustness  in  the  design,  and  to  identify  any  design  flaws  and 
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failure  modes  that  might  exist.  If  sufficient  margin  is  demonstrated,  the  functional  objectives  approach 
provides  protection  against  unknowns. 

Margin  is  relative  to  the  maximum  expected  operating  conditions.  It  may  include  an  increase  in  level  or 
range,  an  increase  in  duration  or  cycles  of  exposure,  or  any  other  appropriate  increase  in  severity.  A 
global  margin  requirement  is  impractical  to  apply  for  an  LRE,  since  the  complex  and  often  very  non¬ 
linear  interactions  in  these  systems  result  in  vastly  differing  conditions  throughout  the  engine.  Thus,  the 
test  margin  conditions  must  be  carefully  selected  to  demonstrate  robustness  for  critical  aspects  of  the 
engine,  while  avoiding  excessive  over-test  of  other  parts.  Margin  requirements  for  specific  objectives  and 
design  aspects  of  LREs  are  discussed  within  the  respective  sections  that  follow. 

4.4.2  Modeling  and  Simulation 

Modeling  and  simulation  is  a  critical  complement  to  testing.  Therefore,  acquisition  of  data  to  validate  and 
calibrate  analytical  models,  for  the  “by  analysis”  element  of  development  and  qualification  verification  of 
requirements,  should  be  a  major  test  objective.  One  of  the  fundamental  purposes  of  testing  is  the 
validation  and  calibration  of  physics-based  models.  Much  effort  is  placed  in  this  area  to  increase  fidelity 
of  the  initial  design,  based  upon  past  experience,  and  to  apply  it  to  new  or  evolved  propulsions  system 
designs.  Analysis  efforts  that  are  inherently  lower  risk  can  be  initiated  earlier  in  the  DDT&E  effort  and 
provide  the  capability  to  explore  many  aspects  of  the  design  prior  to  hardware  manufacture  and  assembly. 
However,  test  data  is  necessary  to  validate  the  analytical  assumptions;  there  is  no  substitution  for  test. 

There  are  test  objectives  tied  to  validating  and  anchoring  models,  which  can  then  be  extrapolated  or 
interpolated  with  confidence  to  verify  functionality  and  performance.  The  goal  is  to  reduce  the  number  of 
tests  necessary  to  provide  the  confidence  necessary  for  flight,  as  well  as  analyze  flight  conditions  that 
cannot  be  adequately  simulated  via  ground  test. 

Modeling  and  simulation  serve  several  important  functions.  First,  they  provide  early  design  guidance  and 
system  characterization.  Second,  they  give  preliminary  analytical  indication  of  functional  performance 
and  integrity,  which  helps  maximize  the  probability  of  successful  verification  during  subsequent  testing. 
Finally,  in  specific  cases,  they  may  provide  sufficient  analytical  verification  without  testing.  This  is 
especially  critical  for  those  aspects  of  engine  performance  and  operation  that  are  impossible  or 
impractical  to  adequately  test  on  the  ground.  Furthermore,  with  the  evolution  of  more  powerful 
computing  capabilities,  advanced  simulation  tools,  and  improved  manufacturing  processes,  recent  engine 
development  and  qualification  programs  have  successfully  utilized  more  extensive  and  accurate  up-front 
robust  design,  sensitivity  studies,  and  optimization  to  reduce  the  common  and  costly  “test-fail-fix”  design 
cycle  during  development  that  has  plagued  many  past  programs.  This  allows  an  earlier  entry  into  the 
verification  phase  of  the  test  program.  Nevertheless,  sufficient  testing  is  required  to  verify  the  design 
since  any  design  result  is  subject  to  the  validity  of  assumptions  and  proper  consideration  of  all  potential 
failure  modes.  Improved  analyses  coupled  with  customary  design  test  verifications  can  yield  better 
reliability  for  the  same  cost,  or  they  can  be  coupled  with  a  reduced  level  of  design  verification  to  yield 
lower  cost  for  the  same  level  of  reliability. 

4.5  Relationship  to  Other  Standards 

An  ERE  may  contain  units  that  are  covered  under  other  standards  documents,  and  the  entire  LRE,  as  a 
pressurized  system,  is  covered  under  SMC-S-005  [2],  This  section  indicates  the  relationship  between  this 
Standard  and  these  other  standards  documents.  The  relationship  with  SMC-S-016  [1]  is  handled 
separately  within  Sections  6,  7,  and  8  of  this  Standard. 
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4.5.1  Systems  Safety 


Launch  systems  are  required  to  comply  with  MIL-STD-882E  [3]  regarding  systems  safety,  and 
AFI  91-217  [5],  which  includes  both  system  safety  and  requirements  for  reentry  or  disposal  at  the  end  of 
the  mission.  These  requirements  pertain  to  the  design  and  development  phase,  and  must  be  considered 
during  the  test  and  evaluation  phase  to  ensure  that  requirements  are  being  met  appropriately. 

4.5.2  Pressure  Vessels  and  Pressurized  Structures 

Storage  of  propellant  and  pressurant  is  either  within  a  pressurized  structure  or  a  pressure  vessel. 
Requirements  for  pressurized  structures  and  pressure  vessels  are  only  relevant  when  those  units  are 
considered  part  of  the  LRE  (they  are  often  considered  separate  from  the  LRE). 

[4.5.2-1]  Metallic  pressurized  vessels  and  pressurized  structures  within  an  LRE  shall  comply  with 
AIAA  S-080-1998  [6]  and  AIAA  S-l  10-2005  [7]  for  both  qualification  and  acceptance. 

[4.5.2-2]  Composite  overwrapped  pressure  vessels  within  an  LRE  shall  comply  with  AIAA  S-081A- 
2006  [8]  for  both  qualification  and  acceptance. 

4.5.3  Pressure  and  Pressure-Loaded  Components 

Many  elements  of  an  LRE  are  considered  pressure  components,  meaning  units  that  hold  pressure.  These 
units  require  pressure  and  leak  testing.  Although  AIAA  S-080-1998  [6]  contains  a  section  for  pressure 
components,  that  section  is  considered  incomplete  for  LRE  application.  As  such,  this  Standard  modifies 
some  of  the  requirements  within  AIAA  S-080-1998  [6]. 

[4.5. 3-1]  Pressure  components  and  pressure -loaded  components  shall  be  verified  to  comply  with  AIAA  S- 
080-1998  [6]  for  both  qualification  and  acceptance  testing,  with  the  exceptions  as  specified  herein 
for  structural  analysis  methodology  (Section  5),  unit  structural  requirements  (Section  6.1 1),  and 
amended  design  factors  (Section  4.6.3). 

4.5.4  Ordnance 

Ordnance  is  typically  not  part  of  an  LRE,  but  can  be.  Ordnance  is  considered  a  unique  unit  type,  and  has 
its  own  compliance  document. 

[4.5.4-1]  Ordnance  within  an  LRE  shall  comply  with  AIAA  S-l  13-2005  [9]. 

4.5.5  Moving  Mechanical  Assemblies 

LRE  may  contain  moving  mechanical  assemblies  (MMA).  MMA  have  unique  requirements.  Some  LRE 
components  and  subassemblies,  such  as  turbomachinery,  may  meet  the  MMA  definition  but  have  unique 
requirements  which  are  specified  in  this  standard.  Other  MMA,  including  valves,  actuators,  electric 
motors,  servos,  gimbals,  gimballed  joints  and  ducts,  and  deployment  mechanisms,  are  subject  to  the 
requirements  of  AIAA  S-l  14-2005  [10]  and  SMC-S-016  [1],  AIAA  S-l  14-2005  [10]  and  SMC-S-016  [1] 
include  tailoring  provisions. 

[4.5.5-1]  MMA  within  an  LRE  shall  comply  with  AIAA  S-l  14-2005  [10]. 


24 


4.5.6  Pressurized  Systems 

Per  the  nomenclature  of  SMC-S-005  [2],  the  LRE  is  a  pressurized  system  with  requirements  pertaining  to 
material  selection,  load  definition,  margin  factors,  and  test  of  the  LRE. 

[4.5.6-1]  LRE  qualification  and  acceptance  shall  conform  to  the  SMC-S-005  [2]  requirements  for  a 
pressurized  system  with  the  exception  of  proof  pressure  test  requirements.  Proof  pressure  is 
handled  differently  within  an  LRE  as  discussed  in  this  Standard’s  Section  7.5. 

4.6  General  Structural  Requirements 

Requirements  for  test  and  analysis  to  verify  the  thermo-structural  capability  presuppose  that  proper 
materials  have  been  selected,  and  appropriate  loads  and  margin  factors  are  utilized. 

4.6.1  Material  Selection 

Structural  elements  have  additional  design  requirements  where  both  the  operational  environment  and  the 
manufacturing  processes  relate  to  the  material  selection. 

[4.6. 1-1]  Engine  materials  shall  meet  the  requirements  in  SMC-S-011  [11]. 

[4.6. 1-2]  Temperatures  of  structural  components  and  bonded  interfaces  shall  remain  within  material 
temperature  limits  specified  to  ensure  their  structural  integrity. 

[4.6. 1-3]  Materials  shall  be  compatible  with  fluids  used  in  test  and  operation. 

[4.6. 1-4]  Physical,  thermal,  mechanical,  strength,  fracture,  creep,  fatigue,  and  any  other  properties  required 
for  a  thermo-structural  analysis,  shall  be  either  determined  from  characterization  testing,  or 
selected  from  validated  sources  such  as  the  Metallic  Materials  Properties  Development  and 
Standardization  (MMPDS)  handbook,  corresponding  to  service  environments. 

[4.6. 1-5]  Material  properties  shall  include  changes  due  to  manufacturing  processes  such  as  temper,  product 
form,  casting,  welding,  thermal  environments  and  conditioning,  chemical  environments  (cleaning 
agents,  fluorescent  penetrants,  etc.),  coatings,  and  test  fluids. 

[4.6. 1-6]  For  all  engine  elements  that  are  either  primary  structures,  fracture-critical,  or  not  fail  safe,  A- 

basis  strength  values  at  the  operating  environments  (e.g.,  moisture  and  temperature)  shall  be  used 
in  the  analytical  assessment.  Otherwise  B-basis  strength  is  acceptable. 

[4.6. 1-7]  The  mean  curve  shall  be  used  to  evaluate  engine  design  for  fatigue,  creep,  and  damage  tolerance. 

The  fatigue  database  may  not  account  for  surface  finish,  size  effects,  residual  stress,  and  loading 
configuration.  The  LCF  scatter  factor  for  well-controlled  samples  can  exceed  7X  service  lives  to  envelop 
90%-99%  of  the  population.  The  material  databases  of  most  engine  programs  may  be  incomplete  and 
unable  to  adequately  characterize  these  uncertainties.  To  increase  the  success  of  the  engine  test  program, 
it  is  recommended  to  use  minimum  properties  for  fatigue,  creep,  and  damage  tolerance  evaluations  when 
possible,  or  increase  the  fatigue  FoS  to  a  value  greater  than  4X.  It  may  be  challenging  to  define  a  single 
minimum  curve.  In  these  instances,  the  curve  enveloping  the  majority  of  the  material  scatter  should  be 
used. 
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[4.6. 1-8]  Material  properties  for  environmentally-induced  degradation  mechanisms  such  as  stress 

corrosion  cracking,  hydrogen  embrittlement,  or  hydrogen-assisted  cracking  shall  be  obtained 
from  characterization  tests  when  applicable  data  is  unavailable. 

4.6.2  Loads 

There  are  two  relevant  load  terms  utilized  within  this  Standard:  Maximum  Expected  Operating  Pressure 
(MEOP)  and  Maximum  Design  Condition  Load  (MDCL).  MEOP  is  part  of  MDCL.  MDCL  is  the  most 
critical  combination  of  load  conditions,  and  includes  steady-state,  vibration,  and  shock  loads.  The  MDCL 
may  be  a  worst  case  combination  of  loads  that  a  structure  may  experience  during  its  service  life  in  the 
specified  environments.  When  a  statistical  estimate  is  applicable,  this  load  corresponds  to  a  99% 
enclosure  with  a  90%  confidence  level.  Steady-state  loads  could  typically  include  a  combination  of 
residual  stresses,  pre-loads/assembly  loads,  pressure  loads,  and  external  loads.  Pressure  loads  could  be 
uniform  or  non-uniform  due  to  aerodynamics,  combustion  gas  flow,  flow  separation,  and  over-pressure. 
Steady  and  transient  thermal  loads  also  require  consideration,  such  as  aerodynamic  or  combustion  gas 
heating  (flow  or  shock  impingement,  flow  separation  and  reattachment,  circumferential  flow,  flow 
recompression  and  shock  formation,  shock-shock  interaction,  plume -plume  interaction,  recirculation, 
etc.).  For  nozzles  operating  with  exit  plane  pressure  less  than  50%  of  the  ambient  (atmospheric)  pressure, 
sub-scale  nozzle  flow  testing  is  recommended  to  determine  the  appropriate  MDCL  accounting  for 
potential  separation  and/or  side  loads.  Further  validation  should  occur  on  full-scale  component  and/or 
engine  tests. 

[4.6.2-1]  The  MEOP  of  the  LRE,  and  its  respective  units,  shall  include  the  peak  transient  pressure,  unless 
the  structure  does  not  respond,  and  comply  with  the  requirements  for  MEOP  within  SMC-S-005 
[2]  (see  section  4.1.1  of  that  standard)  with  the  exception  of  4.1. 1-8  and  4. 1.1-9  in  SMC-S-005 
[2]. 

[4. 6. 2-2]  The  MDCL  shall  be  the  most  critical  condition(s)  considering  all  loads,  and  combinations  of 
loads  and  environments,  that  an  engine  and  its  elements  will  experience  throughout  its  service 
life,  including  pre -launch  operations,  launch,  ascent,  re-entry,  descent,  and  landing.  When  a 
statistical  estimate  is  applicable,  this  load  corresponds  to  a  99%  enclosure  with  a  90%  confidence 
level. 

[4.6.2-3]  MDCL  shall  include  thrust  vector  control,  ignition,  thrust,  vibration,  maneuvering  loads,  and 

loads  determined  by  coupled  system  flexible  body  structural  dynamic  analysis,  corresponding  to 
the  external  load  environment. 

[4.6.2-4]  In  evaluating  the  low-  and  high-cycle  fatigue  life  of  an  engine  element,  the  load  spectra  definition 
shall  consider  the  component  load  history,  including  the  number  of  cycles  or  time  at  each  load 
level  based  on  requirements  of  service  life  (flight  and  non-flight  loads),  and  sustained  loads  such 
as  pressure  and  thermal  loads. 

4.6.3  Factors  of  Safety 

The  required  factors  of  safety  for  LRE  engine  elements  are  provided  in  Table  4-3.  Application  of  damage 
tolerance  (safe -life)  on  pressure  components  and  pressure -loaded  components  allows  the  use  of  lower  FoS 
on  proof  and  ultimate. 

There  may  be  applications  where  it  would  be  impractical  to  conduct  a  structural  qualification  test  and  a 
proof  test.  One  example  is  an  integrated  nozzle  with  cooling  channels.  In  such  an  instance,  structural 
integrity  is  verified  by  engine  life  testing,  fatigue  analysis,  and  strength  analysis.  The  final  verification  of 
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the  flight  unit  is  accomplished  with  a  comprehensive  ND1  to  verify  that  all  flaws  are  within  acceptable 
limits  during  the  service  life  of  the  engine. 

For  weight  and  practical  considerations,  a  yield  factor  lower  than  the  proof  factor  may  be  used.  Proof  test 
could  cause  permanent  changes  to  the  hardware,  which  could  lead  to  subsequent  leakage  or  accelerate 
fatigue  failure.  Therefore,  a  yield  design  factor  lower  than  the  proof  factor  is  allowed  when  material  is 
ductile  (>3%  elongation),  fatigue  requirements  are  met,  and  no  new  failure  modes  are  introduced. 

[4.6. 3-1]  At  a  minimum,  design  analysis  and  test  factors  of  safety  (FoS)  in  Table  4-3  shall  be  used  in  the 
evaluation  of  engine  structural  elements.  These  minimum  factors  are  intended  for  well-controlled 
processes  and  may  need  to  be  increased  to  encompass  process  variations.  For  lines  and  fittings, 
qualification  by  analysis  is  an  acceptable  alternative  to  qualification  testing  using  the  FoS  in 
Table  4-3  under  the  “Pressure  Components  and  Pressure -Loaded  Components  without  Safe -Life” 
classification.  If  it  is  impractical  to  apply  the  Table  4-3  factors,  concurrence  of  the  Approval 
Authority  is  required. 

[4.6. 3-2]  Fitting  factors,  casting  factors,  and  joint  efficiency  factors,  greater  than  or  equal  to  1.0,  shall  be 
applied. 
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Table  4-3.  LRE  Structure  and  Pressure  Component  Factors  of  Safety 


Applicable 

Loads 

Yield 

Proof 

Ultimate 

Unpressurized  Simple  Metallic  Structures 

Qualification  by  Analysis  (1) 

MDCL 

1.25 

Not  applicable 

2.0 

Qualification  by  Analysis  &  Test 

MDCL 

1.23 

1.2 

1.4 

Pressure  Components  and  Pressure-Loaded 
Components  with  Safe-Life 

MDCL 

1.23 

1.2 

1.4 

Pressure  Components  and  Pressure-Loaded 
Components  without  Safe-Life 

Lines  and  Fittings,  Diameter  <  1 .5  inch 

MDCL 

1.5 

1.5 

4.0 

Lines  and  Fittings,  Diameter  >  1 .5  inch 

MDCL 

1.5 

1.5 

2.5 

Fluid  Return  Sections 

MDCL 

1.5 

1.5 

3.0 

Fluid  Return  Hose 

MDCL 

1.5 

1.5 

3.0 

Other  Pressure  Components 

MDCL 

1.5 

1.5 

2.5 

Other  Structures  with  Safe-Life 

Joints  (welds,  brazes,  bonds) 

MDCL 

1.23 

1.2 

1.4 

Composites 

MDCL 

Not  applicable 

1.2 

1.4 

Rotary  Components 

MDCL 

1.23 

1.2 

1.4 

Joints  and  Seals  (2) 

MDCL 

Not  applicable 

1.1  or  1.2 

1.2  or  1.4 

TPS  Structural  Evaluation 

MDCL 

Not  applicable 

1.2 

1.4 

Buckling 

MDCL 

Not  applicable 

Not  applicable 

1.4 

Inadvertent  Contact  (1> 

MDCL 

Not  applicable 

Not  applicable 

1.4 

(1>  Acceptance  test  and  structural  test  are  not  required. 

(2)  See  Section  5.3.4  for  clarification  of  which  factor  to  use. 

(3)  Yield  design  factor  of  safety  of  1 .1  during  proof  is  acceptable  when  material  is  ductile  (>3%  elongation), 


fatigue  requirements  are  met,  and  no  new  failure  modes  are  introduced. 
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5.  Structural  Analysis  Requirements 


The  thermo-structural  qualification  approach  for  engine  structural  elements  requires  a  combination  of 
analysis,  test,  acceptance,  and  inspection  verification.  This  Standard  provides  a  comprehensive  and 
complete  set  of  structural  requirements,  similar  to  NASA  5012B  [18].  This  section  provides  the 
requirements  for  the  thermo-structural  analytical  verification  of  engine  elements.  While  there  are 
analytical  models  utilized  with  test  to  verify  propulsion  performance  and  functional  requirements,  this 
section  is  specific  to  the  thermo-structural  analyses.  Structural  requirements  for  test  are  included  within 
the  unit  and  engine  requirement  sections  (Section  6.1 1  and  Section  7.4,  respectively).  No  distinction  is 
made  between  engines  to  be  used  for  transporting  personnel,  and  those  used  for  transporting  cargo  only. 

The  role  of  analysis  is  to  demonstrate  design  robustness  relative  to  dispersions  in  geometry,  material 
strength,  fatigue,  and  creep  data.  Design  integrity  of  structural  elements  can  be  demonstrated  by  analysis 
alone  in  instances  where  the  analysis  can  be  confidently  accomplished  for  fatigue,  fracture,  buckling,  and 
creep.  Due  to  complexities  associated  with  the  vibratory-thermal-structural  environments  the  engine 
experiences  during  operation,  engine -level  tests  (hot  fire  tests)  are  required  as  part  of  structural 
qualification,  and  constitute  the  primary  approach  to  fatigue  life  demonstration.  Fatigue  analysis  is  still 
required,  as  the  total  stress  in  the  engine  element  can  be  a  combination  of  stresses  induced  by  the  launch 
vehicle  vibrations,  in  addition  to  stresses  from  engine  self-induced  vibrations. 

Thermo-structural  analyses  of  engine  elements  are  typically  performed  using  finite  element  models. 
Structural  analyses  are  conducted  to  evaluate  failure  modes  of  the  engine  using  the  most  appropriate 
solution  procedure,  which  could  include  buckling,  static,  linear,  nonlinear,  and  transient  dynamic 
analyses.  Structural  dynamic  and  stress  models  are  used  in  evaluating  engine  components.  Engine 
structural  dynamic  models  are  integrated  into  coupled  system  models  of  the  launch  vehicle  and  its 
payload;  these  system  models  are  used  to  predict  launch  vehicle  and  payload  launch  and  flight  loads.  The 
launch  vehicle  loads  predictions  include  engine  loads.  Internal  stresses  are  computed  from  stress  models 
by  imposing  thermal  loads,  pressure  loads,  and  external  loads.  Because  of  the  complexity  of  the  structural 
dynamic  and  stress  models,  test  data  is  required  to  adequately  develop  the  high-fidelity  models. 

The  role  of  structural  qualification  tests  is  to  verify  and  validate  analytical  models  and  verify  the  flight 
design.  In  the  absence  of  a  workmanship  issue,  the  structural  qualification  test  increases  the  likelihood  of 
a  successful  proof  test.  An  engine  element  that  does  not  undergo  a  rigorous  structural  qualification  test 
program  can  result  in  a  failure  or  damage  of  the  test  article  during  a  proof  test.  As  such,  engine  elements 
may  be  accepted  for  flight  as  long  as  the  component  passes  a  comprehensive  proof  test,  with  no  damage 
detected  from  a  thorough  post-proof  inspection. 

The  role  of  analysis  is  used  to  ensure  a  successful  structural  qualification  test,  to  define  acceptance  flaw 
criteria,  and  to  demonstrate  that  proof  test  does  not  cause  detrimental  yielding.  There  are  several 
qualification  strategies  for  engine  elements,  as  illustrated  in  Figure  5-1.  An  environmental  correction 
factor  (ECF)  and  external  load  correction  factor  (ELCF)  are  applied  to  adjust  for  differences  between  the 
test  and  flight  conditions.  An  alternate  qualification  strategy  is  to  qualify  an  engine  component  by 
similarity  to  a  previously  qualified  engine  element. 
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Option  1 


Option  2 


Option  3 


Option  4:  Proof  test  logic 


Figure  5-1.  Qualification  strategies  for  engine  elements,  excepting  qualification  by 

analysis  (no  test  option),  and  by  similarity.  ECF  -  Environmental  correction 
factor,  ELCF  -  External  load  correction  factor,  UF  -  Ultimate  Factor,  PF  - 
Proof  Factor 


5.1  Structural  Model 

Local  stress  models  should  include  sufficient  modeling  fidelity  in  areas  of  rapidly  varying  stresses  or 
strains,  and  follow  modeling  “best  practices”  such  as  those  described  in  Management  of  Finite  Elemen  t 
Analysis  -  Guidelines  to  Best  Practice,  published  by  the  National  Agency  for  Finite  Element  Methods 
and  Standards  (NAFEMS).  A  valid  finite  element  model  is  one  where:  (1)  The  geometry,  material 
properties,  mass,  finite  element  selection  (e.g.,  beams,  shells,  solids),  boundary  conditions,  loading 
conditions,  and  stiffness  representation  of  adjoining  structures,  should  be  representative  of  flight 
hardware.  (2)  Element  quality  checks  such  as  aspect  ratio,  Jacobian,  skew,  warpage,  and  other 
characteristics  pass;  that,  if  violated,  could  lead  to  invalid  stress  or  strain  results.  (3)  Mesh  is  sufficiently 
converged.  The  contributions  of  stress  concentration  factors  should  be  included  in  the  final  assessment  of 
the  engine  element. 

[5.1-1]  A  valid  finite  element  model,  or  other  valid  structural  analysis  techniques,  shall  be  used  to 

calculate  the  quantities  necessary  to  meet  the  requirements  in  this  document.  Closed-form  or 
classical  solutions  are  acceptable  if  the  design  geometry  and  loading  conditions  are  simple 
enough  to  warrant  their  application. 

Test  articles  are  instrumented  sufficiently  to  measure  load,  deflection,  and  strains,  for  model  correlation 
and  to  identify  failure  modes.  Typical  correlation  goal  is  that  model  predictions  be  within  +/-10%  of  the 
test  measurements.  Deviations  from  these  goals  should  be  investigated,  since  it  can  affect  the  structural 
evaluation  during  the  design  phase,  during  proof  test  definitions,  and  accurate  evaluation  of  non¬ 
conformances. 

Manufacturing  complexities  for  engine  components  (e.g.  min  radii,  thin  walls)  typically  result  in 
significant  geometric  variations,  and  the  severe  engine  environments  mean  even  relatively  minor 
geometric  variations  may  cause  significant  impacts;  these  aspects  may  not  be  covered  by  a  standard  factor 
of  safety,  and  if  not  evaluated  could  result  in  unexpected  failures  during  structural  qualification  testing  or 
engine  testing.  Engine  components  are  subject  to  extremely  high  and/or  extremely  low  temperatures,  with 
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large  thermal  gradients  through  parts,  making  it  impractical  to  apply  a  FoS  to  the  thermal  portion  of  the 
thermo-mechanical  load.  Other  examples  of  impractical  application  of  FoS  include  cases  where  the  load 
is  limited  by  deflection.  To  address  this  challenge,  the  dimensions  within  drawing  tolerances  that  result  in 
minimum  margins  should  be  selected  along  with  a  minimum  stress-strain  curve  in  a  nonlinear  analysis. 

[5.1-2]  When  analysis  is  used  as  a  verification  method,  analysis  shall  use:  (a)  typical  or  mean  values  for 
physical  properties  at  the  service  environments  (e.g.,  modulus  of  elasticity,  thermal  expansion, 
Poisson  ratio,  etc.);  (b)  dimensions  for  strength  and  life  calculations  such  that  the  calculated 
structural  margin  is  the  minimum  (if  nominal  dimensions  are  used,  accounting  for  minimum 
dimensions  may  be  possible  by  scaling  the  stresses);  and  (c)  stress-strain  curves  based  on  A-Basis 
or  S-Basis  properties,  except  the  nominal  stress-strain  curve  is  used  in  HCF  predictions. 

The  use  of  an  A-Basis  or  S-Basis  stress-strain  curve  may  be  bounding  for  LCF  predictions,  but  may  over¬ 
predict  HCF.  It  is  more  appropriate  to  employ  the  nominal  stress-strain  curve  in  the  evaluation  of  HCF. 

[5.1-3]  The  engine  dynamic  model  shall  meet  the  requirements  in  SMC-S-004  [12]. 

The  model  should  have  sufficient  fidelity  to  capture  the  dynamic  behavior  in  the  relevant  frequency 
range,  and  SMC-S-004  provides  the  mode  survey  test  and  model  correlation  criteria.  Typically  engine 
mode  survey  correlations  are  performed  up  to  70Hz.  Frequencies  greater  than  70Hz  may  need  to  be 
considered  if  the  modal  effective  mass  for  the  system  is  insufficient  for  an  accurate  dynamic  response 
prediction.  The  plan  is  submitted  to  the  Approval  Authority  to  ensure  sufficiency  of  the  modal  dynamic 
characterization. 

5.2  Failure  Modes 

When  calculating  the  structural  margins  of  the  system,  it  is  key  that  for  each  failure  mode,  the  most 
applicable  failure  metric  (e.g.,  stress,  strain,  applied  load)  and  failure  criteria  (e.g.,  strength  allowable, 
strain  allowable,  buckling  load)  are  used  for  all  possible  failure  modes  of  the  structural  component.  In 
certain  cases,  analysis  approaches  for  complex  joints  (such  as  adhesively-bonded,  mechanically-fastened, 
welded,  or  brazed)  are  of  low  confidence.  These  analyses  should  be  anchored  to  representative  coupon  or 
subscale  tests,  which  bound  the  expected  manufacturing  variability. 

[5.2-1]  An  uncertainty  factor  greater  than  1.0  shall  be  applied  as  a  multiplier  to  the  design  factor  of  safety 
when  analysis  of  composites  and  complex  joints  (e.g.,  bonded  joints,  braze  joints)  are  not 
anchored  or  correlated  to  test  data. 

It  is  common  to  apply  an  uncertainty  factor  of  2.0  for  structural  discontinuities  to  account  for  the 
uncertainties  in  predicting  failure  of  joints. 

5.3  Strength  Assessment 

[5.3-1]  The  structural  margin  of  safety  (MS),  MS  =  ALF/FoS  -  1,  shall  be  greater  than  zero  with  the  FoS 
specified  in  Table  4-3,  where  the  allowable  load  factor  (ALF)  is  a  calculated  non-dimensional 
multiplier  to  the  MDCL  that  produces  the  mode  of  failure  (e.g.,  A-Basis  ultimate  strength,  A- 
Basis  yield  strength,  A-Basis  elongation,  buckling,  etc.). 

[5.3-2]  In  the  structural  margin  calculation,  a  unit  factor  shall  be  applied  to  the  portion  of  the  MDCL 
definition  that  increases  the  structural  margins. 


31 


Using  a  buckling  failure  mode  as  an  example,  a  unit  factor  is  applied  to  only  the  portion  of  the  MDCL 
definition  that  has  a  beneficial  effect  on  buckling,  typically  internal  pressure.  A  unit  factor  applied  to  the 
portion  of  the  MDCL  load  that  alleviates  the  failure  mode  may  not  be  sufficient  because  the  load  level 
defined  for  MDCL  is  the  largest  expected  load  corresponding  to  a  99%  enclosure  with  a  90%  confidence 
level.  In  instances  where  pressure  is  the  alleviating  load,  using  the  minimum  expected  value  should  be 
used  with  a  unit  factor  applied  to  this  particular  load  in  the  MDCL  definition.  There  could  be  other 
instances  where  the  mean  expected  value  for  the  alleviating  load  is  more  appropriate  to  use. 

Structural  analysis  of  engine  components  usually  necessitates  nonlinear  structural  analysis,  including  both 
geometric  and  material  nonlinearities.  The  structural  margin  calculation  in  requirement  [5.3-1]  applies  to 
both  linear  and  nonlinear  analysis.  Engine  structural  elements,  subject  to  high  temperatures,  will  often 
require  a  nonlinear  material  and  geometric  analysis.  To  the  extent  practical,  the  FoS  should  be  applied  to 
the  mechanical  and  thermal  portions  of  the  loading,  as  long  as  these  loads  are  non-relieving.  Incorporating 
the  FoS  on  the  thermal  portion  of  the  loading  may  be  impractical  in  a  nonlinear  analysis.  In  some  cases, 
applying  the  FoS  on  deflection-controlled  loads,  such  as  engine  gimballing  may  be  impractical. 

Therefore,  it  is  important  to  analyze  engine  elements  following  the  requirement  in  [5.1-2], 

5.3.1  Strength  and  Yielding 

The  peak  stress  or  peak  strain  should  be  used  in  determining  whether  failure  can  initiate  at  the  outer 
surface  of  the  component  and  propagate  through  the  thickness  of  the  part.  Many  engine  structural 
components  can  have  (1)  unique  geometric  features,  such  as  sharp  radii  or  abrupt  changes  in  geometry, 

(2)  extreme  thermal  gradients,  and  (3)  non-uniform  stresses  that  cause  bending.  These  features  are 
typically  the  initiators  for  cracking.  Plastic  correction  factors,  plastic  bending,  and  fracture  mechanics 
may  be  used  to  evaluate  the  risk  of  failing  the  hardware  when  the  material  allowable  is  exceeded. 

[5. 3. 1-1]  The  structural  margins  of  safety  shall  be  positive  when  the  engine  element  is  evaluated  using  the 
peak  strain  or  peak  stress  at  the  ultimate  load.  Negative  local  yield  margins  of  safety  are 
acceptable  when  all  of  the  following  conditions  are  met: 

a.  The  structural  integrity  of  the  component  is  demonstrated  by  adequate  analysis  and/or  test. 

b.  The  deformations  do  not  adversely  affect  the  component/system  function. 

c.  The  service  life  (fatigue  and  creep)  requirements  are  met. 

Unlike  many  components  of  a  launch  vehicle,  metallic  engine  components  may  undergo  yielding.  In  these 
cases  it  is  necessary  to  ensure  that  yielding  is  not  a  detriment  to  the  function  and  structural  integrity  of  the 
hardware. 


5.3.2  Buckling 

[5. 3.2-1]  Engine  structural  elements  shall  demonstrate  positive  margins  of  safety  against  local  instability, 
global  instability,  and  crippling  using  the  factors  of  safety  in  Table  4-3. 

[5. 3.2-2]  In  instances  where  buckling  is  statically  stable,  the  post-buckling  deformation  at  MDCL  shall  not 
degrade  the  function  of  any  system. 

[5. 3.2-3]  Geometric  and  material  imperfections  in  the  analytical  model  shall  envelope  the  actual  flight 
hardware  condition. 
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Buckling  assessments  may  use  either  linear  or  non-linear  analytical  methods,  whichever  is  more 
appropriate. 

[5. 3.2-4]  For  linear  buckling  analysis  at  MDCL,  ALF  shall  be  taken  as  the  most  critical  buckling 
eigenvalue  multiplied  by  an  imperfection  knockdown  factor  (KF),  which  accounts  for  the 
difference  between  classical  theory  and  empirical  instability  loads.  Typical  knockdown  factors,  as 
listed  in  NASA  SP-8007  [19],  or  other  validated  sources,  may  be  used. 

[5. 3.2-5]  For  non-linear  buckling  analysis,  ALF  shall  be  (1)  calculated  as  a  multiplier  factor  to  MDCL 
corresponding  to  the  point  of  collapse  initiation,  and  (2)  a  bounding  factor  resulting  from  an 
exhaustive  study  that  considers  geometric  imperfection  amplitude,  in  conjunction  with  buckling 
modes,  and  the  combination  of  modes  or  other  imperfection  geometries  deemed  more  critical. 

Buckling,  or  some  other  instability,  can  be  precipitated  by  local  yielding  in  the  structure,  and  this  yield 
point  can  exhibit  statistical  scatter.  To  ensure  that  this  effect  is  accounted  for  in  the  buckling  analysis,  it  is 
necessary  to  use  a  minimum  stress-strain  curve. 

5.3.3  Inadvertent  Contact 

[5. 3.3-1]  Intended  clearances  to  prevent  impact  under  all  conditions  (e.g.,  with  engine  fully  gimbaled) 
shall  be  greater  than  zero  to  prevent  inadvertent  contact: 

Option  A:  Nominal  tolerances,  deformations,  and  thermal  effects  at  1.4  x  MDCL  (e.g.,  with 
engine  fully  gimbaled), 

Option  B:  Worse  case  stack-up  tolerances,  deformations,  and  thermal  effects  at  MDCL. 

5.3.4  Joints  and  Seals 

[5. 3.4-1]  For  separation  critical  joints,  joint  separation  under  worst  case  stacking  tolerances,  environments, 
and  minimum  preload,  shall  not  be  permitted  at  1.2  times  the  MDCL  for  critical  joints  not  leading 
to  a  catastrophic  structural  failure,  and  1.4  times  the  MDCL  otherwise. 

[5. 3. 4-2]  All  of  the  requirements  in  NASA-STD-5020  [13]  shall  be  met,  with  the  exception  of  Sections 
5.1,  5.2,  and  7.7  in  NASA-STD-5020  [13]. 

[5. 3.4-3]  Seals  shall  be  capable  of  accommodating  structural  deflections  and  operating  within  a 

temperature  range  resulting  from  all  environments,  manufacturing  processes,  and  any  engine 
induced  environments,  without  causing  the  seal  to  rupture  or  cause  a  leakage  rate  that  leads  to  a 
violation  of  leakage  requirements. 

Leakage  during  the  qualification  test  program  requires  substantiation  as:  (1)  Non-hazardous  (in  terms  of 
contamination,  corrosion,  fire,  etc.),  (2)  Stable  (additional  starts/duration  demonstrate  stability),  and  (3) 
Does  not  cause  unacceptable  loss  of  performance. 

5.3.5  Failure  Modes  of  Ablative  Thermal  Protection  System  (TPS) 

Key  to  the  overall  TPS  structural  integrity  assessment  is  ensuring  that  the  ablated  structure  (i.e.,  the  end  of 
mission  state  without  the  eroded  material)  can  withstand  the  ultimate  loads.  The  evaluation  should  include 
assessment  of  temperature  extremes.  Often,  the  char  regions  of  the  TPS  will  experience  cracks,  since  the 
material  properties  are  reduced  significantly. 
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[5. 3.5-1]  The  structural  margins  for  all  structural  failure  modes  relevant  to  the  TPS,  and  adjacent 

components,  shall  be  greater  than  zero  at  1.4x  MDCL  (includes  worst-case  heat  loads).  TPS 
regions  which  are  above  their  charring  temperature  may  be  excluded  from  this  requirement. 

5.4  Life  Assessment 

Analytical  assessments  of  thermo-structural  life  include  fatigue,  creep,  and  damage  tolerance  (safe-life) 
aspects.  Fatigue  analysis  is  performed  assuming  no  initial  defects,  while  damage  tolerance  assumes  an 
initial  flaw  size  set  by  the  non-destructive  inspection  (NDI)  limit.  In  the  fatigue  analysis,  a  fatigue 
analysis  factor  (FAF)  is  applied  to  protect  against  high  cycle  fatigue  (HCF)  failures  near  the  endurance 
strength,  where  small  changes  in  stress  can  have  significant  implications  in  the  life  predictions,  and  the 
typical  scatter  factor  of  10,  alone,  is  ineffective.  The  factor  of  10  for  HCF  protects  against  the  scatter  seen 
in  the  high  cycle  fatigue  regime.  High  cycle  fatigue  stresses  are  often  dependent  on  the  line-up  of  natural 
frequencies  with  forcing  functions,  in  addition  to  uncertainties  in  characterizing  forcing  function 
magnitudes,  damping,  and  temperatures.  FAF  also  provides  protection  in  the  LCF  regime  where  4x 
service  lives  may  not  be  sufficient.  A  higher  FAF  is  used  for  rotating  components,  since  there  is  a  higher 
uncertainty  surrounding  fatigue  predictions. 

5.4.1  Fatigue 

[5.4.1-1]  The  predicted  number  of  service  lives  shall  be  at  least  10.0  for  High  Cycle  Fatigue  (HCF),  and 
4.0  for  Low  Cycle  Fatigue  (LCF).  These  factors  may  be  greater  if  the  material  exhibits  higher 
fatigue  scatter. 

[5.4.1-2]  The  fatigue  analysis  factor  (FAF)  of  1.25  for  rotating  components,  and  1.15  for  nonrotating 

components,  shall  be  multiplied  by  the  alternating  stress  before  starting  the  stress-life,  or  by  the 
strain  range  before  stalling  the  strain-life,  fatigue  assessment. 

Mean  stresses  alter  HCF  and  LCF  predictions.  Mean  stress  effects  in  the  HCF  regime  are  usually 
evaluated  with  methods  such  as  the  Modified  Goodman  or  Haigh  diagram.  In  the  LCF  regime,  mean 
stress  effects  are  accounted  using  a  modified  strain-life  relationship.  In  general,  LCF  evaluation  requires 
simulating  multiple  cycles  to  correctly  evaluate  the  strain  range,  and  evaluate  whether  a  larger  strain 
range  could  result  from  cyclic  softening. 

[5. 4.1-3]  Mean  stress  effects  shall  be  accounted  for  in  the  evaluation  of  HCF  and  LCF. 

[5.4.1-4]  The  combined  cumulative  damage  index  (CDI)  due  to  cyclic  loads,  both  HCF  and  LCF,  to 
varying  load  levels  and  cycles,  shall  be  shown  to  be  less  than  0.25  in  lx  service  life  using 
standard  methods  such  as  Miner’s  method. 

5.4.2  Creep 

[5. 4.2-1]  The  predicted  number  of  service  lives  for  the  creep  failure  mode  shall  be  at  least  10.0. 

[5. 4.2-2]  The  stress  or  strain  shall  include  stress  concentration  factors  when  applicable. 

[5.4.2-3]  The  stress  or  strain  shall  be  multiplied  by  a  minimum  factor  of  1.15  before  entering  the  design 
creep  curve  to  determine  life. 
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5.4.3  Damage  Tolerance  (Safe-Life)  Assessment 

Engine  structural  elements  are  generally  classified  as  fracture  critical.  While  this  Standard  does  not 
impose  NASA-STD-5019A  [20]  requirements,  NASA-STD-5019A  [20]  can  be  used  as  guidance  to  assess 
fracture  criticality.  Pressurized  components,  and  pressure -loaded  components,  may  also  be  subjected  to 
damage  tolerance  (safe-life)  verification  to  allow  reduced  FoS  in  regard  to  yield  and  ultimate  (see 
Table  4-3).  These  requirements  are  in  addition  to  strength  requirements  to  prevent  catastrophic  failure  due 
to  material  flaws  under  operational  loads.  Safe -life  analysis  has  successfully  mitigated  structural  failures 
in  ships,  pressure  vessels,  aircraft,  and  launch  vehicles.  For  a  part  to  meet  safe -life  requirements,  cracks 
smaller  than  the  NDI  detection  threshold  must  not  grow  to  unstable  conditions  over  the  required  life  of 
the  structural  component.  There  have  been  instances  where  a  flaw  smaller  than  the  minimum  detectable 
flaw  size  propagated  to  failure  during  the  life  of  a  component.  Flaw  growth  can  be  accelerated  by 
environmental  (e.g.,  hydrogen  embrittlement,  hydrogen  assisted  cracking,  etc.)  and  metallurgical  (e.g. 
large  grains)  factors,  and  therefore  these  need  to  be  carefully  considered  in  the  material  fatigue 
characterization.  Stable  crack  growth  could  cause  a  leak  before  catastrophic  failure,  in  these  cases  the  leak 
is  only  acceptable  when  the  leak  is  non-hazardous,  stable,  and  does  not  cause  unacceptable  loss  in 
performance. 

[5.4.3-1]  For  damage  tolerance  (safe -life)  verification,  the  largest  undetectable  crack  in  a  part  (consistent 
in  size  with  the  proof  test  limits  or  sensitivity  of  the  applied  NDI)  shall  be  shown  by  analysis  or 
test  to  remain  stable  when  subjected  to  cyclic  and  sustained  loads  to  at  least  4  times  the  service 
life.  For  reusable  parts  (e.g.,  reusable  engines),  the  applicable  service  life  definition  for  this 
requirement  is  based  on  the  inspection  interval  (i.e.,  safe -life  assessment  is  based  on  the  last 
inspection). 

Note  that  more  than  4  times  service  lives  may  be  required  if  this  does  not  adequately  cover  the  actual 
fatigue  scatter. 

[5. 4.3-2]  If  proof  test  logic  is  used,  then  the  upper  bound  fracture  toughness  shall  be  used  to  define  the 
initial  flaw  size  prior  to  the  safe-life  assessment. 

[5. 4.3-3]  NDI  shall  be  performed  before  and  after  proof  testing.  Figure  5-1  provides  alternate  qualification, 
acceptance,  and  inspection  methodologies. 

[5.4.3-4]  NDI  techniques  to  define  the  minimum  detectable  flaw  size  shall  be  capable  of  determining  the 
size,  geometry,  location,  and  orientation  of  a  crack  or  a  crack-like  defect  with  a  90%  probability 
of  detection  and  95%  confidence  level. 

Acceptable  flaw  sizes  include  those  from  Table  1  from  NASA-STD-5009  [21]  which  provides  minimum 
detectable  crack  sizes  based  on  the  NDI  technique,  or  alternate  flaw  sizes  based  on  rigorous  probability- 
of-detection  studies. 

Damage  tolerance  evaluation  can  be  verified  by  analysis  if  the  engine  element  is  in  the  elastic  range 
through  its  service  life.  In  instances  where  an  inelastic  response  is  present,  an  accurate  analysis 
necessitates  fatigue-crack  growth  data  in  the  nonlinear  elastic  regime,  and  a  nonlinear  elastic  analysis 
with  accurate  plastic  cycling.  In  these  cases,  a  test  program  to  demonstrate  damage  tolerance  may  be  more 
appropriate. 
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5.5  Turbomachinery  Operation 

Campbell  diagrams  are  typically  used  to  assess  the  dynamics  of  turbomachinery.  A  Campbell  diagram 
provides  a  relationship  of  frequency  versus  the  rotation  speed  of  the  shaft.  Natural  frequencies 
corresponding  to  a  mode,  and  Engine  Order  (EO)  excitations,  are  drawn  against  the  rotation  speed  of  the 
shaft.  A  necessary  condition  for  an  EO  excitation  to  excite  a  bladed-disk  is  that  the  EO  frequency 
coincides  with  the  natural  frequency  of  the  structure.  At  the  intersection  between  the  nth  EO  line  and  the 
line  of  natural  frequencies  of  a  mode  characterized  by  n  nodal  diameters,  a  possible  resonant  condition 
can  be  found.  A  SAFE  diagram  can  also  be  used  in  the  assessment  (refer  to  M.  Singh,  J.  Vargo,  D. 
Schiffer  and  J.  Dello,  “Safe  Diagram  -  A  Design  and  Reliability  Tool  for  Turbine  Blading”,  Dresser-Rand 
Company,  2002  [22]). 

[5.5-1]  Campbell  or  SAFE  diagrams  shall  be  used  to  establish  expected  safe  operating  zones  in  the 
operating  speed  range,  and  avoid  dynamic  resonance  with  a  minimum  frequency  separation 
margin  between  the  component  natural  frequency  and  the  excitation  source  frequency  of  20%. 
Frequency  separation  margin  less  than  20%  is  acceptable  with  test  verification  and  concurrence 
of  the  Approval  Authority. 

[5.5-2]  Campbell  or  SAFE  diagrams  shall  include,  as  a  minimum,  an  evaluation  of  rotating  blades, 

stationary  vanes,  turbine  disks,  and  impellers,  and  consider  modes  subject  to  excitations  driven  by 
the  known  forcing  functions. 

Generally,  the  assessment  includes  the  dynamic  assessment  of  shaft  modes,  with  consideration  of 
interactions  with  bearings,  seals,  imbalance,  shaft  curvature,  and  hydrodynamic  forces. 

5.6  Bellows 

Bellows  structural  analysis  is  usually  not  high  confidence,  due  to  variations  in  convolute  geometry, 
plasticity  occurring  in  these  thin  regions,  and  contact  between  convolutes.  Therefore,  verification  of 
bellows  components  is  primarily  by  test.  Bellows  are  susceptible  to  fatigue  failures,  buckling,  corrosion 
failure,  handling  damage,  failure  due  to  pressure  surge,  and  contaminants  (see  NASA  SP-8123  [23]). 
Based  on  the  history  of  failures  with  bellows,  compliance  documents  such  as  AIAA-S-080-1998  [6]  are 
insufficient  to  ensure  safe  operation  of  bellows.  Therefore,  typical  industry  practice  is  to  impose 
additional  requirements,  which  are  best  described  in  ISO  Standard  10785  [14]. 

[5.6-1]  Bellows  shall  meet  the  requirements  in  ISO  Standard  10785  [14]  except  the  requirements  in 
Sections  5.2.5,  5.2.6,  5.3,  5.2.9,  and  Annex  A  of  ISO  Standard  10785  [14], 

[5.6-2]  The  spring  rate  of  the  bellows  for  each  direction  shall  comply  with  system  requirements  to 

withstand  maximum  expected  load  to  the  adjacent  members  and  maximum  expected  vibration 
modes  of  the  system. 

[5.6-3]  Bellows  with  a  linkage  mechanism  shall  possess  adequate  axial  stiffness  against  pressure  to 
preclude  adjacent  members  from  failing  at  MDCL. 

[5.6-4]  Bellows  stiffness  is  a  part  of  design  and  shall  be  verified  by  testing. 

[5.6-5]  Bellows  design  shall  meet  the  proof  and  burst  factors  in  Table  4-3. 
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5.7  Structural  Qualification  by  Similarity 


Successful  qualification,  production,  and  flight  experience  with  the  heritage  design  of  an  engine  element 
could  be  used  to  develop  qualification  rationale  for  minor  design  changes  to  an  engine  element,  or  for  a 
candidate  engine  element  design.  Differences  between  a  heritage  engine  element,  and  the  candidate 
design,  need  to  be  verified  to  be  minor.  Since  structural  modeling  is  relied  upon  for  the  evaluation  of  the 
candidate  design,  it  is  imperative  for  the  heritage  design  that  the  structural  analysis  be  validated.  Design 
dissimilarities  resulting  from  addition  or  subtraction  of  piece  parts  and  particularly  moving  parts,  ceramic 
or  glass  parts,  crystals,  magnetic  devices,  and  power  conversion  or  distribution  equipment  usually 
compromise  qualification  based  on  similarity. 

[5.7-1]  Qualification  by  similarity  rationale  for  a  candidate  engine  element  shall  meet  the  criteria  (a)-(i)  in 
Section  4.10.1  of  SMC-S-016  [1],  in  addition  to  the  following  criteria: 

j .  All  design  changes  are  thoroughly  evaluated  and  anticipated  failure  modes  remain  identical. 

k.  The  candidate  element  produces  environments  on  other  engine  components  that  are  within 
the  limits  of  those  produced  by  the  heritage  design. 

l.  The  MS  of  the  candidate  design  is  greater  than  or  equal  to  the  MS  of  the  heritage  hardware 
for  each  anticipated  failure  mode. 

5.8  Structural  Approach  Documentation 

The  approach  used  for  structural  verification  is  termed  the  structural  assessment  plan  (SAP),  and  will 
contain  plans  for  both  analyses  and  test.  Fracture  critical  elements  necessitate  a  fracture  control  plan. 

[5.8-1]  The  SAP  shall  be  provided  to  document  how  the  particular  engine  plans  to  satisfy  the  requirements 
of  this  Standard  including  development,  qualification,  and  acceptance  approaches,  analysis 
methods,  and  the  relevant  FoS. 

[5.8-2]  A  Fracture  Control  Plan  and/or  Impact  Damage  Control  Plan  shall  be  provided,  either  in  the  SAP 
or  separately,  documenting  the  hardware-specific  fracture  control  methodologies  and  procedures. 

These  plans  are  typically  produced  at  the  beginning  of  a  program,  before  the  test  and  evaluation  phases 
begin,  but  they  are  essential  to  successful  test  and  evaluation  phases. 
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6.  Unit  Requirements 


The  objective  of  the  overall  qualification  test  program  is  to  yield  a  flight  design,  manufacturing  processes, 
and  acceptance  program  that  produces  flight  hardware  and  software  that  meet  specification  and 
performance  requirements  with  adequate  margin  to  accommodate  normal  hardware  variations. 

Acceptance  tests  verify  the  performance  against  the  specification  and  demonstrate  acceptable 
workmanship  in  manufacturing. 

The  generic  unit  test  requirements  in  SMC-S-016  [1]  are  further  refined,  and  in  some  cases  expanded,  in 
this  Standard  specifically  addressing  application  to  LRE  unit  testing.  Units  acting  in  concert  with  other 
elements  may  defer  testing  to  a  higher  assembly  level  as  long  as  test  objectives  and  test  perceptiveness  for 
requirement  verification  are  maintained.  Depending  upon  the  unit,  a  mix  of  functional  and  performance 
tests  are  typically  conducted  prior  to  delivery  of  the  component  to  the  next  higher  level  of  assembly. 

6.1  Unit  Verification  by  LRE  Test 

Since  engines  are  hot-fire  tested  for  acceptance,  installed  components  will  receive  a  level  of  testing  above 
the  unit  acceptance  test  procedure  (ATP).  This  reduces  the  risk  of  a  future  failure  due  to  manufacturing 
and  assembly  issues.  Component  acceptance  testing  at  the  bench  level  serves  to  reduce  risk  for  engine 
testing,  but  it  often  cannot  adequately  simulate  the  engine  environments. 

A  line  replaceable  unit  (LRU)  is  one  that  may  be  removed  and  replaced  within  an  LRE  without  adversely 
affecting  the  performance  verification  of  the  LRE,  or  will  impact  performance  only  within  some 
understood  and  properly  allocated  uncertainty.  Example  LRUs  are  igniters  and  isolation  valves.  To  be 
considered  an  LRU,  the  unit’s  interaction  with  the  LRE  must  be  fully  characterized  via  LRE  testing. 

[6.1-1]  All  components  of  an  LRE  shall  be  hot-fire  tested  on  an  engine,  except  in  cases  where  unit  level 

acceptance  testing  can  replicate  the  engine  environment  and/or  adequately  screen  components,  or 
the  component  is  designed  for  a  single  use;  exclusions  require  Approval  Authority  concurrence. 
LRUs  may  be  substituted  into  an  engine  without  requiring  that  particular  engine  to  repeat  hot-fire 
testing,  but  the  LRU  must  still  have  undergone  hot-fire  test  on  an  engine  with  adequate 
instrumentation  to  verify  the  component  is  acceptable. 

[6.1-2]  An  LRU  shall  be  verified  by  testing  to  have  either  a  trivial  effect  on  LRE  performance  and 
reliability,  or  a  known,  well-characterized,  and  predictable  effect  on  LRE  performance  and 
reliability. 

Units  excluded  (with  Approval  Authority  concurrence)  from  engine  hot-fire  testing  are  typically  restricted 
to  those  unaffected  by  the  thermal-pressure-vibration  environment  of  the  engine  (which  is  difficult  to 
replicate),  simple  components  with  high  structural  margins,  or  those  that  are  designed  for  a  single  use 
(e.g.,  ablative  nozzles  or  pyrotechnic  igniters). 

6.2  Unit  Inspection 

[6.2-1]  Units  within  an  LRE  shall  comply  with  the  inspection  requirements  of  SMC-S-016  [1]  (Paragraph 
4.6)  for  unit  qualification  and  unit  acceptance. 

6.3  Unit  Performance  Requirements 

SMC-S-016  [1]  combines  performance  and  functional  testing,  whereas  this  Standard  differentiates  the 
tests.  Functional  test  requirements  are  detailed  in  this  Standard  within  Section  6.4. 
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Performance  of  a  unit  includes  many  aspects  with  requirements  specific  to  the  various  types  of  units.  For 
example,  contamination  control,  while  a  design  aspect,  is  verified  by  cleanliness  tests.  These  cleanliness 
tests  are  considered  part  of  performance  verification.  Qualification  performance  testing  includes  showing 
margin  beyond  the  expected  maximum  and  minimum  conditions.  The  amount  of  margin  varies;  the 
appropriate  value  is  specific  to  the  unit  type  and  application. 

[6.3-1]  Units  within  an  LRE  shall  comply  with  the  performance  requirements  of  SMC-S-016  [1] 
(Paragraph  6.3.2)  for  unit  qualification  and  unit  acceptance. 

Additional  requirements  are  included  in  the  following  sections  for  LRE-specific  components  and  aspects. 

6.3.1  Ignition  System 

Significant  unit  or  subsystem  type  testing  should  be  conducted  on  ignition  systems  to  minimize  risk  to 
engine  level  testing.  The  environment  of  the  start  condition  is  important,  and  the  type  of  ignition  system 
will  affect  the  parameters  of  interest  (including  mixture  ratio,  temperature,  pressure,  and  input  voltage). 
Unit  testing  can  verify  compliance  to  unit  design  specifications,  but  ignition  system  verification  for  an 
LRE  ultimately  must  occur  at  the  engine  level  (see  Section  7.2.7). 

6.3.2  Turbomachinery 

Analytical  models  for  steady  state  performance  utilize  turbomachinery  performance  maps  to  predict 
overall  engine  performance.  These  maps  are  initially  predicted  analytically  and  need  test  validation. 
Ideally,  the  testing  would  span  the  ranges  of  the  expected  “3-sigma”  operating  band  with  some  excursions 
outside  of  that  range.  Consideration  must  be  given  to  performance  over  time  in  a  single  burn  as  well  as 
over  the  engine’s  life  expectancy.  Engine  performance  predictions  will  depend  upon  turbine  and  pump 
efficiencies  and  net  positive  suction  pressure  (NPSP)  performance.  Inherent  inefficiencies  drive  the  need 
for  additional  turbine  drive  power  requirements  for  the  system.  Turbine  flow  area  can  carry  uncertainty 
that  affects  engine  performance  and  prediction  capability.  The  secondary  flows  (bearing  coolant  flows, 
thrust  balance  fluid  pressures,  inter-propellant  seal  purges,  etc.)  also  need  validation,  as  these  can  affect 
system  performance,  functionality,  and  margins. 

Turbomachinery  is  technically  a  combination  of  several  units  that  function  together.  Performance  testing 
requires  the  full  combination  of  units  acting  together,  although  limited  functional  testing  at  the  individual 
unit  level  is  still  possible.  For  engines  utilizing  turbomachinery,  subscale  testing  of  the  turbine  and  pump, 
flowing  air  and  water,  respectively,  is  recommended.  These  lower  level  tests  validate  turbine  flow  path 
and  pump/inducer  performance.  Full  scale  turbomachinery  tests  are  performed  to  obtain  mapping 
information  for  engine  performance.  These  tests  are  typically  either  performed  in  a  dedicated 
turbomachinery  test  rig  or  facility,  or  at  the  engine  level  during  development  hot  fire  testing.  For  tests 
performed  in  a  turbomachinery  test  facility,  the  test  facility  will  have  some  method  to  drive  the 
turbomachinery  and  control  speed  that  may  not  match  the  turbine  drive  on  the  engine.  The  pump  may  or 
may  not  pump  the  same  fluid  as  the  engine.  The  test  drive  gas  and  pumping  fluid  should  be  matched  to 
the  engine  to  the  maximum  extent  practical.  This  testing  may  include  “powerpack”  type  configurations, 
which  typically  include  turbomachinery  and  major  combustion  devices  in  an  integrated  package,  to 
provide  supplemental  characterization  prior  to,  or  in  parallel  with,  the  full  engine  development  test 
program. 

[6. 3.2-1]  For  engines  utilizing  turbomachinery,  a  full-scale  turbomachinery  test  shall  be  conducted  to 

obtain  mapping  information  for  engine  performance  across  the  entire  range  of  expected  operating 
conditions,  including  expected  excursions  and  sensitivities  to  secondary  flow  variations.  These 
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tests  may  be  performed  in  a  dedicated  turbomachinery  test  rig  or  facility,  or  at  the  engine  level 
during  development. 

Temporal  and  spatial  variations/distributions  in  gas  temperature  at  the  turbine  inlet  should  be 
characterized,  then  verified  by  test  at  the  component  and/or  engine  level. 

6.3.3  Combustion  Devices  and  Combustion  Stability 

Combustion  device  performance  is  ultimately  verified  at  the  engine  level  for  the  operating  conditions  (see 
Section  7.2.9).  At  the  component  level,  subscale  testing  is  used  to  characterize  combustion  efficiency  and 
injector  pressure  drop.  Calorimeter  spool  pieces  can  be  used  to  estimate  combustion  chamber  heat 
loads/fluxes.  Component  testing  is  used  to  reduce  risk  to  the  engine  test  program.  A  full-scale  component 
test  for  stability  verification  is  recommended  as  risk  reduction  prior  to  the  engine-level  test  verification 
effort.  Ultimately,  combustion  stability  must  be  verified  at  the  engine  level  per  [7.2.9-2J. 

Turbine  drives  for  LRE  cycles  with  a  pre-burner  (PB)  or  gas  generator  (GG)  may  be  sensitive  to 
temperature  distributions  at  the  inlet,  which  may  necessitate  design  features  into  the  associated  PB  or  GG 
to  minimize  this  effect. 

PBs  and  GGs,  if  present  in  the  LRE  cycle,  should  undergo  component  level  testing  to  verify  combustion 
efficiency,  injector  delta  pressure,  and  temperature  distributions  entering  the  turbine. 

6.4  Unit  Functional  Characteristics 

6.4.1  Cold  Flow  Tests 

[6.4.1-1]  Cold  flow  tests,  using  either  the  engine  working  fluids  or  suitable  alternatives,  shall  be  conducted 
on  units  within  the  flowing  system  to  characterize  their  behavior.  Test  results  are  to  be  compared 
to  predictions  to  verify  resistances,  pressure  drops,  temperatures,  and  flow  rates  are  within 
expectations  and  design  requirements. 

6.4.2  Transient  Characterization 

Due  to  the  complexity  and  severity  of  environments  in  LRE  systems,  it  is  typically  quite  challenging  to 
properly  characterize  the  engine  transient  environment  at  the  component  level  in  general.  However,  unit 
resistances  can  be  characterized  as  a  risk  reduction  step  for  powerpack  and  engine  level  testing.  Units 
may  include  valves,  injectors,  and  flow  restrictions.  Unit  testing  may  include  “powerpack”  type 
configurations,  which  typically  include  turbomachinery  and  major  combustion  devices  in  an  integrated 
package,  to  help  develop  and  establish  the  proper  start  transient  control  sequencing  and  timing  prior  to 
engine  level  testing.  Ultimately,  acceptable  transient  behavior  must  be  verified  at  the  engine  level  (see 
Section  7.3.5). 

[6.4.2-1]  Units  shall  be  tested,  on  a  best-effort  basis,  to  characterize  their  transient  behavior,  including 
start-up  and  shut-down,  and  reduce  risk  for  engine -level  testing.  In  addition  to  verifying 
specification  requirements,  the  test  results  are  to  be  compared  to  predictions  and  should  be  used 
in  engine  system  models  and  verification  steps. 

6.4.3  NPSP  Margin  and  Cavitation 

NPSP  is  the  pressure  difference  between  the  total  pressure  and  vapor  pressure  of  a  liquid  propellant  at  a 
given  temperature.  For  engines  with  liquid  pumps,  this  is  a  key  parameter  to  quantify  what  is  known  as 
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suction  performance.  This  parameter  must  be  thoroughly  understood  and  characterized  during 
development.  Low  inlet  pressure  to  a  pump  can  lead  to  significant  cavitation  which  can  reduce  pump 
performance  with  corresponding  reduced  discharge  pressure  (commonly  referred  to  as  head  fall-off. 
where  acceptable  head  fall-off  is  typically  no  worse  than  ~2-3 %  degradation  in  pump  discharge  pressure) 
and/or  damage  or  fail  hardware.  Lower  tank  operating  pressures  for  vehicle  systems  are  desirable  to 
reduce  tank  weight,  but  a  minimum  NPSP  must  be  maintained  to  avoid  significant  pump  cavitation.  The 
margin  is  analytically  predicted,  along  with  the  turbopump  performance  maps  anchored  to  test  data,  and 
incorporated  into  engine  steady  state  performance  and  transient  models. 

Component-level  pump  tests  are  often  conducted  using  subscale  hardware  at  scaled  speeds  using  simulant 
fluids  (such  as  water)  that  may  not  adequately  represent  the  true  flight  operating  environment.  Even  full 
scale  turbopump  component  tests  pumping  flight  propellants  may  not  identify  all  cavitation  issues  due  to 
the  variety  and  complexity  of  possible  cavitation  phenomena  and  the  potential  for  impact  from  unknown 
engine  system  effects.  For  these  reasons,  component-level  testing  is  useful  to  identify  expected  engine- 
level  suction  performance,  but  does  not  satisfy  the  requirement  for  turbomachinery  powerpack  and/or 
engine -level  testing,  which  is  required  to  validate  the  component  level  findings  (see  Section  7.3.6). 

Pump  conditions,  equivalent  to  the  engine  operating  range,  should  be  mapped  in  terms  of  the 
dimensionless  pump  parameters  which  govern  cavitation  behavior,  namely  cavitation  number  and  flow 
coefficient,  accounting  for  uncertainties  derived  from  measurement  uncertainties,  hardware  variation,  and 
ground-to-flight  differences. 

[6.4.3-1]  For  engines  utilizing  liquid  pumps,  adequate  steady  state  pump  performance  and  acceptable  head 
fall-off  with  decreasing  NPSP  shall  be  verified  by  test,  including  margin  testing  outside  of  the 
pump  inlet  box  and  below  the  specified  minimum  NPSP  requirement  for  each  propellant  (see  the 
last  paragraph  of  Section  7.3.6  for  margin  selection  guidance).  Test  durations  at  the  minimum 
NPSP  condition  should  be  sufficiently  long  to  collect  steady  state  performance  data. 

[6.43-2]  For  engines  utilizing  liquid  pumps,  cavitation  behavior  testing  shall  cover  (with  sufficient 

resolution)  the  entire  range  of  flow  coefficients  and  cavitation  numbers  (aka  cavitation  space) 
corresponding  to  the  entire  range  of  specification  allowable  and  expected  engine  operating 
conditions,  including  expected  excursions  and  ground-to-flight  differences. 

[6.4.3-3]  Cavitation  mapping  information  shall  describe  the  structure  (alternate  blade,  high-order  surge, 
high-order  rotating,  etc.),  strength  (vibratory  and/or  pressure  fluctuation  amplitudes),  and  extent 
(operating  parameter  range)  of  cavitation  instabilities. 

[6.4.3-4]  The  NPSP  margin  and  cavitation  testing  implementation  plan  shall  include  the  following 
elements: 

a)  Proper  location  of  propellant  inlet  temperature,  pressure,  and  flow  rate  measurements  for 
determination  of  cavitation  number  and  flow  coefficient.  These  should  be  located  as  close 
as  possible  to  flight  measurement  locations  or  corrected  to  flight  measurement  locations. 
Inlet  pressure  measurements  should  be  sufficiently  far  upstream  to  prevent  erroneous 
pressure  readings  that  may  be  caused  by  local  backflow  near  the  inducer  inlet. 

b)  Proper  location  of  axial  and  radial  accelerometers  on  the  pump  housings  to  quantify  the 
strength  and  oscillation  frequencies  associated  with  cavitation  instabilities.  Also,  if 
possible,  one  or  more  close-coupled  dynamic  pressure  transducers  should  be  included  at  or 
near  the  inducer  inlet. 
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c)  Sufficient  frequency  response  and  sample  rates  of  accelerometers  and  pressure  transducers 
to  resolve  the  frequencies  associated  with  the  highest  frequency  cavitation  instabilities 
(which  are  typically  10-12  times  the  rotor  shaft  speed). 

d)  Employment  of  pressure  transducer  arrays  (e.g.,  circumferential  array)  if  cavitation 
instabilities  are  observed,  to  identify  the  structure  and  rotation  rate  of  the  cavitation 
disturbance. 

e)  Working  fluid  cleanliness  and  dissolved  gas  content  levels  representative  of  flight 
conditions. 

f)  Flight  representative  feedline  geometries. 

[6.4.3-5]  Testing  shall  verify  design  robustness  and  life  margin,  against  any  observed  cavitation  or  flow 
instability  behavior  that  cannot  be  eliminated,  by  accumulating  4x  worst-case  exposure  duration 
(4x  exposure  service  life)  to  that  instability. 

[6.4.3-6]  Acceptance  testing  shall  verify  characteristic  cavitation  responses  of  production  engines,  and 

ensure  that  high  cycle  fatigue  damage  potential  at  the  end  of  production  engine  service  life  will  be 
bounded  by  qualification  with  margin  per  [6.4.3-5]. 

[6.4.3-7]  Post-test  integrity  of  critical  hardware  (e.g.,  inducer  and  impeller  blades)  shall  be  verified  via 
sufficient  inspection  methods  (e.g.,  dye  penetrant  inspection),  either  periodically  throughout  the 
test  series  or  at  the  end  of  the  test  series. 

Additional  rationale  and  guidance  can  be  found  in  JANNAF-GL-2012-01-R0  [17]  paragraphs  4.4.5, 

4.4.5. 1,  and  4.4.5.2. 

6.4.4  Pogo  and  Pump  Compliance  Characterization 

Pogo  is  a  fluid-structural  instability  that  can  cause  catastrophic  loss  of  a  vehicle.  Characterization  of 
engine  compliance  by  testing  becomes  an  important  part  of  anchoring  the  analytical  models  and  helps 
determine  if  a  pogo  accumulator  is  required. 

Ultimately,  compliance  characterization  must  be  done  at  the  engine  level  (see  Section  7.3.7),  but  pump 
characteristics  should  be  determined  at  the  component  level. 

6.4.5  Engine  Controls 

The  engine  control  system  acts  as  the  nervous  system.  It  sends  commands  throughout  the  engine  and 
communicates  with  the  stage/vehicle.  It  also  collects  and  distributes  engine  data  as  necessary.  This 
subsystem  is  a  vital  contributor  to  the  engine  as  a  whole.  Functional  tests  are  initially  run  separate  from 
the  FRE  (at  unit  or  a  subsystem  level),  often  in  a  laboratory  environment  (e.g.,  hardware-in-the-loop). 
Vehicle  commands  and  other  communication  may  be  simulated. 

[6.4.5-1]  Tests  of  engine  controls  shall  use  integrated  software  and  electronic  hardware  to  verify  the 

engine  control  system  can  reliably  and  accurately  satisfy  specification  requirements  for  startup, 
steady  state  operation,  throttling,  shutdown,  and  aborts. 

[6.4.5-2]  Tests  of  engine  controls  shall  verify  data  collection  and  transfer  characteristics,  and  verify 

response  time  characteristics  (i.e.,  response  time  between  receipt  of  command  and  actual  physical 
response  of  fluid,  mechanical,  or  electronic  devices). 
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[6.4.5-3]  Tests  of  engine  controls  shall  include  standard  command  and  control  type  activities  and  data 
transfer  activities  in  relation  to  engine  health  management  (EHM)  validation. 

6.5  Unit  Leakage  Test 

Leak  testing  is  relevant  to  units  and  subsystems  that  maintain  a  certain  pressure  as  part  of  their  functional 
operation  (i.e.,  pressure  vessels,  pressurized  structures,  and  pressure  components).  Unit  leakage  must  be 
limited  to  within  design  allowables  that  have  been  carefully  developed  with  consideration  of  system  level 
requirements.  Sections  4.5.2  and  4.5.3  require  pressurized  units  within  an  LRE  to  comply  with  AIAA-S- 
080  [6]  or  AIAA-S-081A  [8],  both  of  which  require  leak  testing.  SMC-S-016  [1]  specifies  how  to 
perform  the  leak  testing. 

[6.5-1]  Units  within  an  LRE  shall  comply  with  the  leakage  requirements  of  SMC-S-016  [1]  (Paragraph 
6.3.3)  for  unit  qualification  and  unit  acceptance. 

Joints  and  seals,  such  as  those  within  turbomachinery,  must  prevent  leakage  under  structural  loading. 

[6.5-2]  Tests  shall  demonstrate  acceptable  separation  leakage  at  1.4  x  MDCL  for  a  leakage  leading  to  a 
catastrophic  event  and  1 .2  x  MDCL  otherwise.  The  failure  mode  under  consideration  is  rupture 
of  a  seal  or  leakage  rate  leading  to  mission  degradation.  Analysis  requirements  in  Section  5.3.4 
are  an  acceptable  alternative  to  testing  when  seal  deflection  modeling  tools  are  anchored  to  seal 
tester  data. 

For  many  LRE  unit  types  this  testing  would  be  impractical,  requiring  that  special  tooling  be  designed  to 
load  and  leak  check  seals  at  all  the  locations  on  an  LRE.  Seal  deflection  modeling  tools,  anchored  to  seal 
tester  data,  have  alternatively  been  used  successfully. 

6.6  Unit  Shock  Test 

Shock  testing  is  not  always  applicable,  and  is  termed  Evaluation  Required  within  SMC-S-016  [1].  Units 
where  the  test  is  not  relevant  still  require  a  one-time  justification  document  detailing  the  rationale. 

[6.6-1]  Units  within  an  LRE  which  have  been  evaluated  to  require  unit-level  shock  testing  shall  comply 
with  the  shock  requirements  of  SMC-S-016  [1]  (Paragraph  6.3.4)  for  unit  qualification  and  unit 
acceptance. 

6.7  Unit  Vibration  and  Acoustic  Test 

LREs  contain  vibration  sensitive  components  such  as  actuators,  mission  critical  sensors,  valves,  electric 
components,  and  bellows.  Per  paragraph  6  of  this  Standard  and  SMC-S-016  [1]  Paragraph  4.4.1,  unit- 
level  testing  may  be  deferred  to  a  higher  assembly-level  test  or  engine-level  test  with  appropriate 
rationale,  and  concurrence  of  the  Approval  Authority. 

[6.7-1]  Units  within  an  LRE  which  have  been  evaluated  to  require  unit-level  vibration  and/or  acoustic 

testing  shall  comply  with  the  vibration  and  acoustic  requirements  of  SMC-S-016  [1]  (Paragraphs 
6.3.5  and  6.3.6)  for  unit  qualification  and  unit  acceptance. 

[6.7-2]  The  maximum  expected  environments  used  in  vibration  testing  shall  envelope  all  phases  of  flight. 
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6.8  Unit  Acceleration  Test 


Acceleration  testing  is  Evaluation  Required  and  may  not  be  applicable  for  many  units. 

[6.8-1]  Units  within  an  LRE  which  have  been  evaluated  to  require  unit-level  acceleration  testing  shall 
comply  with  the  acceleration  requirements  of  SMC-S-016  [1]  (Paragraph  6.3.7)  for  unit 
qualification. 

6.9  Unit  Thermal  Tests 

Per  paragraph  6  of  this  Standard  and  SMC-S-016  [1]  Paragraph  4.4.1,  unit-level  testing  may  be  deferred 
to  a  higher  assembly-level  test  or  engine-level  test  with  appropriate  rationale,  and  concurrence  of  the 
Approval  Authority. 

[6.9-1]  Units  within  an  LRE  which  have  been  evaluated  to  require  unit-level  thermal  cycle  and  thermal 

vacuum  testing  shall  comply  with  the  thermal  cycle  and  thermal  vacuum  requirements  of  SMC-S- 
016  [1]  (Paragraphs  6.3.8  and  6.3.9)  for  unit  qualification  and  unit  acceptance. 

6.10  Unit  Climatic  Test 

[6.10-1]  Units  within  an  LRE  shall  comply  with  the  climatic  requirements  of  SMC-S-016  [1]  (Paragraph 
6.3.10)  for  unit  qualification. 

6.11  Unit  Structural  Requirements 

Verification  of  structural  integrity  includes  static  load  testing,  and  may  also  include  tests  for  buckling, 
fatigue,  and  damage  tolerance  (safe-life)  when  analyses  are  insufficient.  The  test  articles  are 
manufactured  using  representative  processes,  and  with  established  process  controls.  The  purpose  of  proof 
test  is  to  screen  for  gross  workmanship  flaws  and  should  be  defined  to  be  worse  than  the  flight 
environments.  The  proof  factor  provides  margin  relative  to  flight  conditions  for  both  analysis  uncertainty 
and  workmanship  variability.  It  is  often  prudent  to  perform  proof  tests  at  the  component  or  subassembly- 
level  in  order  to  screen  out  issues  before  rework  or  repairs  become  difficult  or  expensive.  The  proof  test 
compensates  for  differences  between  flight  and  test  conditions.  Differences  may  include  loads, 
environments,  and  boundary  conditions. 

If  there  is  only  low  or  moderate  confidence  in  analysis  results,  then  tests  are  needed  to  achieve  high 
confidence  in  the  verification  of  structural  capability.  Tests  may  be  needed  when  analysis  methods  for  a 
design  must  be  extrapolated  to  a  domain  beyond  which  they  have  been  validated,  when  analysis  or 
environmental  inputs  are  not  adequately  characterized,  or  when  complex  fluid-structure  interactions  play 
a  significant  role  in  the  state  of  stress. 

[6.11-1]  Ultimate  strength  tests  shall  be  conducted  on  dedicated  qualification  engine  components, 

including  rotors,  pressure  vessels,  and  pressurized  components,  using  the  loads  and  factors  listed 
in  Table  4-3. 

[6.11-2]  Proof  tests  shall  be  conducted  on  flight  engine  components,  including  rotors,  pressure  vessels, 
and  pressurized  components,  using  the  loads  and  factors  listed  in  Table  4-3. 

[6.1 1-3]  The  boundary  and  loading  conditions  applied  to  the  test  article  shall  be  in  such  a  manner  to 
produce  flight-like  stress  states  in  the  appropriate  environment. 
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[6.11-4]  The  applied  loads  shall  be  compensated  for  any  differences  between  test  and  flight  conditions 
including  missing  loads,  environmental  conditions  (e.g.,  temperature,  moisture),  and  boundary 
conditions. 

When  pressure,  thermal  gradients,  or  other  complex  loadings  are  present,  it  may  be  challenging  to  define 
a  proper  room  temperature  proof  or  structural  test.  In  these  instances,  it  is  important  to  ensure  that  the 
proof  test  is  exercising  the  failure  mode  in  a  manner  consistent  with  flight  conditions.  When  differences 
between  test  and  flight  conditions  are  considered,  the  effective  proof  factor  should  follow  the  values 
specified  in  Table  4-3.  The  effective  proof  factor  can  be  readily  established  by  analyzing  the  proof  test 
and  flight  configurations. 

[6.1 1-5]  No  failure  shall  occur  at  or  below  the  ultimate  load,  or  the  specified  margin  factor  beyond  the 
service  life  (i.e.,  lOx  for  HCF,  and  4x  for  LCF). 

[6.11-6]  For  strength  and  buckling  tests,  when  a  load  component  alleviates  failure  under  combined  load 
conditions,  a  unit  factor  shall  be  applied  to  that  load  component  of  the  MDCL  condition. 

See  Section  5.3  for  additional  guidance  on  the  application  of  a  unit  factor  on  the  load  that  alleviates  the 
mode  of  failure. 

[6.11-7]  Buckling  tests  shall  not  fail  at  or  below  ultimate  load  using  test  articles  that  include  worse-case 
load  eccentricities  and/or  geometric  imperfections  based  on  measured  data  (e.g.,  laser  scan,  etc.). 
Analysis  is  an  acceptable  alternative  to  buckling  tests  when  the  stiffness  and  load-path  is 
anchored  to  structural  test. 

Testing  is  performed  with  an  article  that  incorporates  the  worst-case  imperfections  expected  during  the 
life  of  the  program,  or  based  on  bounding  imperfections  allowed  by  the  drawing. 

The  primary  approach  for  fatigue  verification  is  engine  qualification  tests  to  4X  starts  and  4X  duration. 
Ground  engine  qualification  tests  may  not  fully  envelope  the  self-induced  vibrations  and  launch  vehicle 
vibrations.  Analytical  approaches  for  evaluating  fatigue  become  key  in  the  structural  assessment  process, 
and  should  employ  an  applicable  material  fatigue  database  (e.g.,  surface  finish,  loading  condition,  and 
environments). 

[6.11-8]  Fatigue  tests  shall  be  conducted  at  the  most  severe  environments  utilizing  a  load  spectra  definition 
which  includes  alternating  and  mean  stresses  applied  to  the  test  article  to  at  least  4  times  the 
number  of  service  lives  (the  Fatigue  and  Damage  Tolerance  Factor  in  Table  4-1).  Analysis 
requirements  in  Section  5.4.1  are  an  acceptable  alternative  to  tests  when  the  analysis 
methodology  is  anchored  to  test  data. 

An  example  of  a  low-to-moderate  confidence  engine  structural  component  is  bellows.  These  are  typically 
qualified  separately  as  described  in  Section  5.6. 

[6.11-9]  Damage  tolerance  (safe -life)  testing  shall  be  conducted  with  the  load  spectra  applied  to  the  test 
article  to  at  least  four  times  the  number  of  service  lives  (the  Fatigue  and  Damage  Tolerance 
Factor  in  Table  4-1).  Analyses  requirements  in  Section  5.4.3  are  an  acceptable  alternative  to  tests 
when  the  analysis  methodology  is  anchored  to  test  data. 
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6.12  Unit  Electromagnetic  Compatibility  Test 

Electromagnetic  Compatibility  (EMC)  testing  is  Evaluation  Required  within  SMC-S-016  [1]  as  these 
tests  are  not  always  applicable  to  the  type  of  unit. 

[6.12-1]  Units  within  an  LRE  which  have  been  evaluated  to  require  unit-level  EMC  testing  shall  comply 
with  the  electromagnetic  compatibility  (EMC)  requirements  of  SMC-S-016  [1]  (Paragraph 
6.3.13)  for  unit  qualification  and  unit  acceptance. 

6.13  Unit  Life  and  Wear-in  Test 

Qualification  of  an  engine  for  flight  includes  showing  margin  to  the  maximum  expected  operational  life. 
This  is  one  aspect  of  demonstrating  hardware  robustness.  Life  limited  parts  are  expected,  and  can  drive 
engine  maintenance  intervals  and  total  life.  Acceptance  tests  will  not  include  life  testing,  but  are  to 
include  wear-in  tests  to  detect  material  and  workmanship  defects  that  occur  early  in  the  unit  life. 

6.13.1  Operational  Lifetime 

SMC-S-016  [1]  requires  life  testing  as  part  of  unit  qualification.  LRE  units  are  also  required  to  verify  life 
as  part  of  qualification,  but  operational  life  testing  of  some  LRE  units  may  be  performed  at  a  higher-level 
assembly.  Life  verification  in  regards  to  fatigue  and  damage  tolerance  is  within  Section  6.11.  Life 
verification  of  nozzles  is  done  at  the  engine  level  per  Section  7.7.3. 

[6.13.1-1]  Qualification  for  units  (other  than  nozzles)  with  life  limitations  set  by  phenomenon  other  than 
fatigue  shall  include  life  testing  per  SMC-S-016  [1],  Paragraph  6.3.14,  but  may  defer  unit-level 
life  testing  to  a  higher-level  assembly. 

6.13.2  Single  Burn  Operation  Duration 

[6.13.2-1]  Unit  qualification  shall  include  sustained  operation  for  a  duration  greater  than  or  equal  to  the 
maximum  expected  mission  single  burn  duration  with  margin  as  specified  in  Table  4-1  for  Unit 
Single  Burn  Operation  Demonstration  Factor. 

6.13.3  Operational  Life  Starts 

Engine  starts  are  a  significant  hardware  durability  driver,  and  a  major  component  of  life  calculations, 
especially  for  LCF  damage.  Stalling  and  stopping  of  units  within  an  engine  result  in  significant  thermal 
and  pressure  gradients  in  a  very  short  period  of  time,  which  is  very  stressing  to  hardware.  Start  capability 
limited  by  fatigue  effects  are  covered  under  Section  6.1 1  for  unit  qualification.  Start  capability 
verification  of  nozzles  is  done  at  the  engine  level  per  Section  7.7.3. 

[6.13.3-1]  Unit  qualification  for  start  capability  limitations,  other  than  fatigue  effects  (and  not  including 
nozzles),  shall  be  tested  per  SMC-S-016  [1],  Paragraph  6.3.14,  but  unit-level  life  testing  may  be 
deferred  to  a  higher-level  assembly. 

6.13.4  Unit  Acceptance  Wear-In 

Wear-in  is  an  aspect  of  unit  ATP. 

[6.13.4-1]  Units  within  an  LRE  shall  comply  with  the  wear-in  requirements  of  SMC-S-016  [1] 

(Paragraph  6.3.1)  for  unit  acceptance. 
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Note  that  6.3.1  of  SMC-S-016  [1]  refers  to  AIAA-S-1 14-2005  [10]  for  MMA  (already  required  per 
[4. 5.5-1]). 
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7.  Engine  Requirements 


The  objective  of  the  overall  development  and  qualification  test  program  is  to  yield  a  flight  design, 
manufacturing  processes,  and  acceptance  program  that  produces  flight  hardware/software  that  meet 
specification  and  performance  requirements  with  adequate  margin  to  accommodate  normal  engine 
hardware  variations.  The  LRE  test  program  (together  with  appropriate  analyses)  verifies  requirements 
compliance.  Engine  level  testing  is  necessary  because  of  the  significant  component-to-component 
interactions,  unknown  environments,  and  nonlinearities  that  cannot  be  adequately  predicted  nor  replicated 
at  lower  system  levels.  The  LRE  includes  an  assembly  of  all  of  the  primary  subsystems  (e.g.,  TPA)  as 
well  as  all  major  components  (e.g.,  valves  and  combustion  devices).  Engine  level  testing  is  critical  to 
design  verification  since  there  are  significant  interactions  between  the  various  components  and 
subsystems  that  cannot  otherwise  be  simulated  or  characterized.  Furthermore,  it  is  difficult  and  often 
impossible  to  test  components  and  subsystems  in  the  actual  engine  environment  other  than  through  their 
testing  at  the  engine  level  itself.  Component  testing  may  address  individual  environmental  stresses  and 
the  impact  to  the  functional  capability,  whereas  the  engine  level  introduces  systems  interactions  and 
combined  environments  (engine  self-induced).  Most  of  the  test  requirements  will  be  pertinent  to  this  level 
of  testing.  Development  testing  is  required  to  achieve  design  maturity,  demonstrate  capability,  and  to 
reduce  risk  to  the  qualification  program.  Qualification  testing  is  required  to  formally  verify  compliance  of 
the  flight  design  with  requirements.  Acceptance  testing  verifies  the  flight  worthiness  of  each  specific 
deliverable  unit. 

Per  the  nomenclature  of  SMC-S-016  [1],  the  LRE  is  a  Bus  subsystem.  Bus  subsystem  test  requirements 
are  within  Tables  7.3-1  and  7.3-2  of  SMC-S-016  [1]  but  are  generically  written  for  any  subsystem.  This 
Standard  includes  further  specific  requirements  in  the  sections  indicated  in  Table  7-1. 

Table  7-1.  Relationship  between  SMC-S-016  [1]  Bus  Subsystem  Requirements  and  the  LRE  Standard 


SMC-S-016  Bus  Subsystem  Test  Requirements 

LRE  Standard 

Test 

Qualification 

Acceptance 

Section 

Inspection 

R 

R 

7.9.1  and  7.9.2 

Performance 

R 

R 

7.2  and  7.3 

Static  Load 

R 

ER 

7.4 

Pressure  and  Leak 

ER 

R 

7.5 

Shock 

ER 

ER 

7.6.3 

Random  Vibration  or  Acoustic 

ER 

- 

7.6.3 

Thermal  Vacuum 

ER 

ER 

7.6.1 

Separation  and  Deployment 

R 

R 

7.3.9 

Electromagnetic  Compatibility 

R 

ER 

7.6.5 

Mode  Survey 

R 

- 

5.1 

R  =  Required;  ER  =  Evaluation  Required 


7.1  Test  Types 

Even  though  requirements  levied  upon  a  propulsion  system  can  vary  from  system  to  system,  the  types  of 
tests  are  relatively  well  known.  These  establish  the  basic  functionality  and  overall  robustness  of  an  engine 
or  integrated  propulsion  system.  This  section  identifies  the  different  test  types  with  the  following  sections 
providing  the  detailed  requirements  for  each  type. 
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7.1.1  Development 

Development  tests  are  conducted  for  the  following  reasons: 

•  Validate  new  design  concepts  or  the  application  of  proven  concepts  and  techniques  to  a  new 
configuration 

•  Assist  in  the  evolution  of  designs  from  the  conceptual  phase  to  the  operational  phase 

•  Validate  design  changes 

•  Expand,  update,  and  anchor  models 

•  Reduce  the  risk  involved  in  committing  designs  to  the  fabrication  of  qualification  and  flight 
hardware 

•  Develop  and  validate  qualification  and  acceptance  test  procedures 

•  Investigate  problems  or  concerns  that  arise  after  successful  qualification 

Development  test  conditions  should  encompass  worst-case  conditions  for  the  intended  application.  In 
addition,  the  development  program  is  used  to  verify  margin,  outside  the  operating  envelopes,  by  test. 
Margin  testing  will  allow  a  successful  development  program  to  identify  weak  aspects  in  the  design, 
identify,  eliminate,  and/or  mitigate  failure  modes  prior  to  beginning  qualification,  and  ultimately  yield  a 
much  more  robust  design.  However,  development  testing  should  avoid  conditions  that  violate  acceptable 
safety  margins  or  cause  unrealistic  modes  of  failure. 

Development  testing  is  not  explicitly  required.  Development  testing  is,  however,  expected  and 
recommended  since  omission  of  development  testing  is  likely  to  result  in  increased  qualification  test 
failures,  and  a  lack  of  understanding  of  the  design  weaknesses  and  limitations.  Furthermore,  per 
Section  4.3  and  Table  4-1,  a  certain  number  of  development  engine  samples  may  be  used  to  help  satisfy 
the  required  number  of  verification  engine  samples,  provided  that  those  units  are  structurally  and 
functionally  equivalent  to  the  qualification  and  flight  design,  and  meet  the  instrumentation  requirements 
(see  [4.3. 1-1]  and  [4.3. 1-3]). 

7.1.2  Qualification 

Qualification  testing  provides  formal  verification  that  the  final  design,  manufacturing  processes,  and 
acceptance  program  produce  flight  hardware/software  that  meet  specification  and  performance 
requirements  with  adequate  margin  to  accommodate  expected  variations  in  hardware  and  engine 
operation.  It  generally  follows  completion  (or  near  completion)  of  the  development  test  program  to  reduce 
program  risk  at  this  phase.  Testing  should  validate  the  planned  acceptance  program,  including  test 
techniques,  procedures,  equipment,  instrumentation,  and  software,  as  well  as  potential  rework  and  repeat 
test  cycles. 

Qualification  engine  samples  are  typically  the  first  engines  off  the  production  line  to  demonstrate 
readiness  for  flight  operation.  Manufacture  of  the  qualification  units  should  use  the  same  drawings, 
materials,  tooling,  manufacturing  processes,  level  of  personnel  competency,  and  quality  control  as  will  be 
used  for  actual  flight  hardware.  Limited  deviations  are  permitted,  but  only  if  required  to  accommodate 
benign  changes  that  are  necessary  to  conduct  the  testing  (e.g.,  adding  instrumentation  to  record  functional 
parameters  for  engineering  evaluation).  Other  deviations  may  be  proposed  to,  and  potentially  accepted  by, 
the  Approval  Authority.  Feedlines  should  also  be  as  flight  representative  as  possible,  especially  at  the 
integrated  propulsion  system  level  testing. 

Qualification  testing  verifies  satisfaction  of  design  requirements,  especially  margin  and  product 
robustness  for  designs  that  have  no  demonstrated  history.  A  full  qualification  validates  the  planned 
acceptance  program,  in-process  stress  screens,  and  retest  environmental  stresses  resulting  from  failure  and 
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rework.  Qualification  testing  verifies  compliance  to  engine  specification  requirements  and  vehicle 
interface  requirements  over  the  entire  range  of  expected  operating  conditions.  Overall  qualification  test 
conditions  should  encompass  worst-case  conditions  for  all  intended  applications.  Selected  margin 
conditions  (e.g.,  operating  life  margin,  thrust  margin,  mixture  ratio  margin)  are  also  verified  to 
demonstrate  robustness.  However,  qualification  testing  should  not  create  conditions  that  violate 
acceptable  safety  margins  or  cause  unrealistic  modes  of  failure. 

[7. 1.2-1]  LRE  qualification  test  requirements  shall  be  verified  by  testing  on  flight  design  engine  samples 
(i.e.,  verification  engine  samples). 

Verification  engines  include  qualification  engines,  but  may  also  include  development  engines  that  are 
structurally  and  functionally  equivalent  to  the  qualification  units  and  flight  design.  Additional  leeway 
exists  in  relation  to  specific  verification  tests.  For  example,  verification  of  the  ignition  system  requires 
that  the  engine  under  test  have  a  flight  design  ignition  system  and  related  elements,  but  the  engine  could 
conceivably  have  other  elements  that  are  not  flight-like.  Such  a  unit  could  satisfy  ignition  system 
verification  but  would  not  count  toward  the  total  number  of  engines  required  per  Table  4-1  (see  also 
Section  4.3). 

7.1.3  Acceptance 

LRE  acceptance  tests  are  conducted  to  demonstrate  the  acceptability  of  each  deliverable  item  to  meet 
performance  specification  and  demonstrate  acceptable  workmanship  in  manufacturing.  Acceptance 
testing  of  an  LRE  includes  hot-fire  testing  to  ensure  the  article  is  acceptable  for  delivery.  Because  of  the 
combination  of  complex  components,  significant  dependency  on  functional  timing,  and  strict  performance 
bands,  engine  testing  is  a  necessary  part  of  acceptance  of  flight  propulsion  systems.  The  criticality  and 
complexity  of  LREs  require  that  performance  be  calibrated  and  measured.  Verified  performance 
parameters  include  thrust,  mixture  ratio,  and  flow  rate  (for  derivation  of  Isp).  In  addition,  selected  critical 
operating  conditions,  key  interface  conditions,  and  other  specification  requirements  must  be 
demonstrated.  Verification  of  workmanship  is  a  critical  aspect  of  the  acceptance  hot-fire  test  since 
discrepancies  are  not  always  detected  during  the  build  process.  The  extreme  thermal,  pressure,  and 
dynamic  environments  during  engine  operation  can  cause  failure  if  workmanship  flaws  exist.  Acceptance 
testing  is  intended  to  stress  screen  hardware  items  to  nominal  operational  levels  to  precipitate  incipient 
failures  due  to  latent  defects  in  parts,  processes,  materials,  and  workmanship  prior  to  flight. 

[7. 1.3-1]  Acceptance  testing,  to  include  hot-fire  testing,  shall  be  conducted  on  each  LRE  to  verify 
performance  conditions  and  intended  calibration. 

[7. 1.3-2]  Successful  acceptance  testing  shall  exclude  structural  failures  and  detrimental  structural 
conditions. 

Generally,  acceptance  test  operating  conditions  should  remain  well  within  the  operating  envelope.  Since 
the  hardware  being  tested  is  intended  for  flight  and  should  not  be  significantly  overstressed,  margins  are 
tested  only  for  certain  aspects.  For  example,  operating  margins  may  be  exercised  (1)  during  a  structural  or 
pressure  test  conducted  on  the  flight  article  to  levels  higher  than  maximum  design  condition  (MDC), 
maximum  expected  operating  pressure  (MEOP),  etc.,  to  verify  material  quality  and  workmanship;  (2)  for 
confidence  building  against  specific  technical  issues;  and/or  (3)  to  verify  that  the  flight  unit  behaves 
similarly  to  the  qualification  units  at  specific  off-nominal  conditions.  The  appropriate  numbers  of  starts 
and  duration  is  a  trade  between  obtaining  sufficient  ground  test  time  to  accurately  establish  performance 
and  reliably  screen  workmanship  issues,  versus  minimizing  the  expenditure  of  operating  life.  The  most 
appropriate  starts/duration  will  depend  on  the  engine  design,  performance  repeatability,  and 
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manufacturing  maturity,  as  well  as  the  number  and  severity  of  any  unique  persisting  technical  issues  that 
require  special  testing  to  resolve  prior  to  flight. 

The  acceptance  series  functionally  checks  critical  systems  and  performance.  Engine-level  acceptance  tests 
should  closely  resemble  key  portions  of  the  intended,  or  typical,  mission  profiles  in  terms  of  thrust, 
mixture  ratio,  power  level  transition  rates  (start,  throttle,  shutdown),  etc.  Associated  test  parameters  and 
instrumentation  are  expected  to  align  with  the  development  and  qualification  experience.  The  goal  is  to 
acquire  enough  data  and  characterization  to  confidently  show  the  engine  performs  within  required  limits, 
confirm  normal  operational  behavior,  and  quote  expected  flight  performance  (i.e.,  performance  tag) 
utilizing  the  acceptance  test  results. 

7.2  Performance 

Test  programs  should  conduct  enough  testing  to  sufficiently  characterize  the  different  performance 
parameters  and  their  sensitivities.  Thrust,  specific  impulse,  and  mixture  ratio  are  all  examples  of 
performance  parameters  that  must  be  measured  or  computed/derived  from  measured  data  during  engine 
test,  to  thoroughly  validate  analysis  models  over  a  range  of  input  variations,  and  to  minimize 
extrapolation  to  flight  operation  outside  the  family  of  ground  test  data.  Accurate  measurement  and 
characterization  is  necessary  as  the  vehicle  requires  characterization  of  engine  performance  over  the  flight 
profile  to  properly  calculate  propellant  load  and  reserves,  and  calculate  vehicle  guidance,  navigation  and 
control  parameters,  etc. 

7.2.1  Steady  State  Performance  Characterization 

Steady  state  operation  refers  to  a  condition  or  state  in  which  key  parameters  of  interest  (e.g.,  thrust)  are 
either  constant,  or  slowly  changing  at  a  constant  rate.  There  may  remain  some  small  noise-like  variation, 
but  no  rapid  time  dependency.  Typically,  thrust,  pressure,  and  temperature  must  all  reach  this  condition 
for  engine  operation  to  be  considered  steady  state,  although  some  engine  designs  may  achieve  steady  state 
thrust  prior  to  steady  state  thermal  conditions  prevailing.  The  test  puipose  must  be  considered  when 
establishing  which  parameters  must  be  steady  state.  Most  commonly,  the  ultimate  objective  is  to 
characterize  how  well  the  actual  flight  performance  of  the  engine  corresponds  to  the  intended, 
commanded,  and/or  predicted  performance.  As  an  example,  if  mean  thrust  remains  unchanged  with  time 
(having  only  noise-like  or  minor  roughness  variation)  after  60  seconds  of  operation  following  a 
commanded  transition  event  (e.g.,  start  command  or  throttle  transition),  then  60  seconds  could  be 
considered  the  minimum  operating  duration  to  reach  steady  state  thrust  after  said  commanded  event. 

Since  noise-like  variations  do  occur,  however,  steady  state  conditions  should  be  time-averaged  over  a 
finite  dwell  period  of  steady  operation,  thereby  necessitating  operating  times  longer  than  the  minimum  to 
determine  the  steady  state  thrust  behavior.  In  most  cases,  different  engines  will  require  different  durations 
after  a  commanded  event  to  reach  steady  state. 

Steady  state  performance  should  be  thoroughly  characterized  by  varying  parameters  across  the  expected 
acceptance  test  and  flight  regimes,  to  validate  analytical  models,  minimize  uncertainties,  and  minimize 
flight  risks.  The  engine  physics-based  steady  state  model  should  be  validated  and  anchored  by  test  data 
such  that  “3-sigma”  conditions,  including  build-to-build  and  run-to-run  variations,  can  be  evaluated  and 
shown  to  still  fall  within  requirement  limits.  Establishing  and  validating  engine  gains  and  “influence 
coefficients”  related  to  interface  conditions  are  inherently  part  of  this  model  validation  activity.  To 
accomplish  this,  multiple  engine  tests  on  each  design  are  expected.  Performance  measurements  are 
expected  to  occur  during  steady  state  time  slices  during  a  test  where  no  commanded  changes  occur,  or 
enough  time  has  elapsed  to  reach  steady  state  conditions. 
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[7. 2. 1-1]  LRE  hot-fire  testing  shall  include  measurements  of  steady-state  thrust  and  steady-state  propellant 
flow  rates.  Replacement  of  these  measurements  by  other  parameters  that  are  directly  related,  such 
as  chamber  pressure  for  thrust,  may  be  used  with  the  consent  of  the  approval  authority. 

[7.2. 1-2]  LRE  hot-fire  testing  shall  include  diagnostic  measurements,  including  critical  pressures  and 
temperatures  within  the  engine  to  characterize  normal  variability,  and  verify  appropriate  LRE 
behavior  and  health.  It  is  typical  to  see  engine  performance  data  adjusted  to  a  set  of  standard 
propellant  conditions  at  the  engine  interface. 

[7.2. 1-3]  LRE  qualification  hot-fire  testing  shall  include  steady-state  performance  measurements  at  all 
power  levels  within  the  allowed  range  of  steady  state  operation,  with  emphasis  at  power  levels 
where  the  engine  spends  a  significant  portion  of  the  mission. 

[7.2. 1-4]  LRE  qualification  hot-fire  testing  of  throttleable  engines  shall  include  performance  verification 
across  all  allowed  throttling  ranges.  This  may  be  accomplished  by  tests  that  include  throttling  or 
by  testing  multiple  discrete  conditions  across  the  throttling  range  per  [7.2.5-2], 

[7.2. 1-5]  An  LRE  hot-fire  acceptance  test  of  sufficient  duration  shall  demonstrate  acceptable  operation 
with  respect  to  any  significant  run-time  trends  or  sensitivities  identified  during  qualification, 
ensuring  that  the  production  engine  is  bounded  by,  or  in  family  with,  qualification. 

[7.2. 1-6]  If  orifice,  valve,  or  valve  position  changes  are  required,  or  some  performance-related 

change/procedure  is  conducted,  then  a  validation  hot-fire  acceptance  test  run  shall  be  conducted 
to  verify  the  final  configuration,  unless  the  changed  component  is  an  LRU,  or  the  trim  adjustment 
without  retest  has  been  similarly  qualified.  LRU  demonstrations  are  required  to  verify  negligible, 
or  characterized,  performance  effects  for  any  significant  hardware  changes  which  are  planned  to 
occur  without  a  validation  hot-fire  acceptance  test  run  on  the  flight  engine  (see  Section  7.9.6). 

Sometimes  the  full  flight  nozzle  may  not  be  acceptance  tested  with  the  LRE  due  to  a  nozzle’s  intended 
single-use  application  (e.g.,  ablative  nozzle),  or  test  facility  limitations  (e.g.,  no  vacuum  test  capability  for 
a  high  expansion  ratio  nozzle).  Lurthermore,  sometimes  the  LRE  may  instead  be  acceptance  tested  with  a 
truncated  nozzle  (intended  to  characterize  nozzle  wall  heat  transfer  characteristics  for  the  specific  injector 
environment,  and/or  to  provide  an  intermediate  expansion  ratio  within  facility  capabilities).  In  these  cases, 
the  measured  thrust  and  Isp  for  the  LRE,  without  the  full  flight  nozzle,  must  be  adjusted  to  properly 
account  for  the  truncated  ground  test  configuration. 

[7.2. 1-7]  If  the  LRE  is  not  ground  acceptance  tested  with  the  flight  nozzle,  LRE  qualification  shall  provide 
sufficient  performance  data  for  both  the  intended  flight  configuration  and  acceptance  test 
configuration,  in  order  to  develop  sufficiently-accurate  correlations,  in  conjunction  with  validated 
analytical  tools  and  methodologies,  to  correct  ground  acceptance  test  thrust  and  Isp,  measured 
without  the  full  flight  nozzle. 

7.2.2  Repeatability 

Run-to-run  and  engine -to-engine  variations  in  thrust,  mixture  ratio  (MR),  Isp,  and  other  key  engine 
operating  parameters  are  to  be  evaluated  during  the  test  program.  The  objective  is  to  gain  sufficient  test 
data  to  understand  the  typical  variation  and  ensure  that  the  variation  is  controlled  well  enough  such  that 
an  engine  can  be  effectively  tuned  to  meet  performance  and  functional  requirements.  Three  tests  on  a 
given  engine  sample  are  required  to  provide  a  reasonably  low  uncertainty  (three  times  lower  than  for  only 
two  data  points)  in  the  ground-to-flight  prediction.  This  is  consistent  with  the  engine  performance 
repeatability  guidelines  in  JANNAL-GL-20 1 2-0 1 -R0  [  1 7] . 
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[7. 2.2-1]  LRE  hot-fire  qualification  testing  shall  include  at  least  three  tests  on  the  same  engine  sample, 

each  with  portions  of  the  test  that  have  identical  stabilized  test  conditions  (e.g.,  engine  control  set 
points,  propellant  inlet  conditions,  other  interface  conditions)  to  allow  characterization  of  the  run- 
to-run  variability. 

[7. 2.2-2]  Engine  designs  with  multiple  power  levels  or  continuous  throttling  capability  shall  include 

additional  sets  of  identical  tests  to  characterize  the  most  critical  performance  regimes  based  upon 
the  intended  and  specification  usage  profile(s)  (e.g.,  thrust,  mixture  ratio). 

[7. 2.2-3]  The  same  repeated  hot-fire  tests  of  [7. 2.2-1]  shall  be  run  on  each  of  three  engine  samples  to  allow 
characterization  of  the  engine-to-engine  variability.  Inclusion  of  the  test  series  across  all 
verification  engine  samples  and  within  development  testing  is  preferred  to  maximize  the  data  for 
use  in  unit-to-unit  variability  characterization. 

[7.2.2-4]  LRE  hot-fire  acceptance  testing  shall  include  at  least  one  repeated  test  period  with  identical  test 
conditions  leading  to  a  representative  performance  characterization  (i.e.,  the  entire  test  need  not 
be  repeated)  to  verify  consistency  in  the  run-to-run  variability  with  the  qualification  data  set. 

After  obtaining  significant  operational  history,  with  repeatable  acceptance  of  production  engines,  the 
supplier  may  delete  the  acceptance  repeat  test  [7.2.2-4J  if  the  Approval  Authority  concurs. 

7.2.3  Run-Time  Trends 

Run-time  trend  data  are  an  important  diagnostic  to  identify  any  uncommanded  and/or  unintended  time 
varying  operating  conditions  that  might  exist  for  thrust,  Isp,  MR,  shaft  speeds,  pressures,  temperatures,  or 
component  efficiencies,  such  that  they  can  be  properly  considered  and  accommodated. 

[7. 2.3-1]  LRE  hot-fire  qualification  and  acceptance  testing  shall  monitor  time-dependent  parameter  trends, 
and  account  for  them,  if  significant. 

[7. 2.3-2]  Significant  unexpected  trends  and/or  extrapolations  that  suggest  potential  exceedance  of 

specification  limits  or  qualified  engine  operating  conditions  shall  require  further  disposition 
and/or  corrective  actions. 

7.2.4  Steady  State  Analytical  Models 

Steady  state  analytical  models  predict  engine  internal  operational  conditions  (e.g.,  pressures, 
temperatures,  and  flow  rates)  based  upon  specified  input  conditions  and  known  or  expected  hardware 
characteristics.  Preferably  a  model  is  physically-based,  and  exercising  the  model  by  varying  the  input 
parameters  results  in  influence  coefficients  that  represent  incremental  changes  in  various  engine 
performance  parameters  given  the  incremental  change  in  input.  Modeling  and  determination  of  dependent 
parameters  are  expected  to  be  initiated  during  the  development  phase. 

[7. 2.4-1]  LRE  qualification  testing  shall  determine  and  verify  influence  coefficients  based  on  inlet 

conditions,  valve  positions  if  applicable,  and  other  interface  conditions  for  steady  state  LRE 
performance  (e.g.,  thrust,  Isp,  MR)  and  key  operating  conditions  (e.g.,  shaft  speeds,  chamber 
pressures  and  temperatures,  pump  discharge  pressures)  across  the  entire  intended  operational 
regime.  Actual  parameters  will  vary  depending  upon  the  engine  design. 
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7.2.5  Thrust  and  Mixture  Ratio  Excursion  Tests 


The  thrust  (e.g.,  power  level)  and  mixture  ratio  excursion  test  campaign  should  characterize  the  engine 
hardware  sensitivity  to  operating  point  variations.  Doing  so  will  help  characterize  engine  behavior  and 
verify  hardware  durability.  Depending  on  engine  configuration  and  vehicle  application,  significant  power 
level  and  mixture  ratio  variation  may  be  a  desired  and/or  deliberate  functionality.  However,  the  engine 
also  has  to  accommodate  variations  due  to  vehicle  stage  operation,  such  as  variations  in  propellant  inlet 
conditions  (e.g.,  run  box  variations).  Some  systems  may  have  control  features  to  minimize  variations 
(closed-loop  control),  but  others  may  elect  to  tolerate  these  external  variations  (open-loop  control). 

For  a  trimmed  engine,  Figure  7-1  details  the  allowable  control  limits  as  the  “trim  box”.  Worst-case 
dispersions,  biases,  and  variations  (pump  inlet  conditions,  run-time  trends,  hardware  replacements,  etc.) 
can  drive  those  limits  farther  in  flight  to  the  extent  of  the  “flight  box”.  The  flight  box  bounds  the  full 
range  of  power  levels  and  mixture  ratios  that  may  be  seen  in  flight,  and  must  be  thoroughly  tested. 
Margin  should  also  be  demonstrated  against  the  flight  box,  per  Section  7.2.6.  For  engines  with  open-loop 
control,  worst-case  pump  inlet  conditions  will  result  in  power  level  and  MR  conditions  that  are  more 
extreme.  For  engines  with  closed-loop  control,  the  engine  operating  parameters  will  become  more 
extreme  when  worst-case  inlet  conditions  are  applied.  Note  that  for  engines  with  closed-loop  control  on 
both  thrust  and  MR,  the  Trim  and  Flight  Boxes  can  nearly  become  the  same  box  boundary,  differing  only 
by  run-to-run  variability  (or  control  uncertainty). 
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Figure  7-1.  Notional  diagram  of  power  level  versus  mixture  ratio  trim  box,  flight  box  (with  internal  and 
perimeter  bins),  and  margin  box  (showing  margin  demonstration  locations). 
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[7. 2.5-1]  Worst-case  conditions  for  LRE  qualification  hot-fire  testing  shall  account  for  all  significant 
dispersions  and  biases  (and  be  included  in  the  [4.2-1]  test  plan),  including  specification  limits, 
run-to-run  variations,  measurement  uncertainty,  ground-to-flight  dispersions,  operating  biases 
(e.g.,  extreme  inlet  conditions),  run-time  trends,  and  potential  post-test  engine  hardware 
replacements. 

[7. 2.5-2]  The  flight  box  of  allowable  power  levels  and  mixture  ratios  shall  be  discretized  into  bins 

spanning  no  greater  than  5%  of  maximum  power  level,  and  no  greater  than  5%  of  nominal  MR 
(unless  confident  analysis  establishes  other  bin  increments  are  more  appropriate),  which  represent 
operating  points  for  testing. 

[7. 2. 5 -3]  The  perimeter  bins  of  the  flight  box  shall  be  defined  relative  to  the  trim  box  such  that  when  the 
engine  is  commanded  to  maximum  or  minimum  power  level  and/or  MR  of  the  trim  box,  with 
nominal  inlet  conditions,  the  engine  will  be  operating  within  a  perimeter  bin. 

[7. 2.5-4]  At  least  50%  of  the  operating  time  in  perimeter  bins  shall  be  performed  with  worst-case  pump 
inlet  conditions  applied,  or  at  equivalent  engine  conditions  achieved  by  other  means 
(demonstrated  as  equivalent  via  an  evaluation  comparing  the  engine  response  [e.g.,  critical 
parameters  such  as  shaft  speed,  chamber  temperature,  valve  delta-pressure]  with  respect  to  that 
driven  by  worst-case  inlet  conditions),  unless  bin-specific  engine  operating  conditions  (e.g.,  shaft 
speed,  chamber  temperature,  and  valve  delta-pressure)  are  bounded  by  the  flight  box  margin 
demonstrations  of  [7.2.6-1]. 

[7.2.5-5]  The  qualification  hot  fire  tests  for  each  bin  of  [7. 2.5-2]  shall  accumulate  duration  at  least  lx  the 
bin-specific  service  life  (for  example,  in  Figure  7-1,  the  bin  C5  service  life  may  be  400  sec,  and 
the  bin  E2  service  life  may  be  20  sec.),  including  at  least  one  continuous  steady-state  dwell 
enveloping  the  longest  instance  of  continuous  dwell  operation  within  that  bin  over  the  engine’s 
service  life. 

[7. 2.5-6]  The  sum  of  qualification  hot  fire  test  operation  at  a  given  power  level  (for  example,  at  the  lowest 
thrust  level,  the  accumulated  duration  in  bins  Al,Bl,Cl,...,Flin  Figure  7-1)  shall  accumulate 
duration  at  least  2x  the  engine  service  life  specific  to  that  power  level  (for  example,  at  the  lowest 
thrust  level,  the  sum  of  the  bin-specific  service  lives  of  bins  A1,B1,C1,  ...  ,F1  in  Figure  7-1). 

7.2.6  Thrust  and  Mixture  Ratio  Margin  Demonstration 

The  objective  here  is  to  envelope  extreme  operating  conditions,  and  verify  engine  robustness  via  margin 
testing  on  thrust  and  MR  beyond  expected  worst-case  flight  box  conditions.  Certain  margin  condition 
combinations  may  be  deleted  from  the  test  series,  provided  that  those  deleted  combinations  can  be 
confidently  shown  to  be  well  bounded  by  the  combinations  that  are  tested  with  respect  to  engine 
robustness/health  (e.g.,  maximum  shaft  speeds,  peak  pressures,  minimum  cooling,  extreme  valve 
positions)  and  functional  capability  (e.g.,  achievable  thrust  level). 

[7. 2.6-1]  The  verification  hot-fire  testing  shall  include  a  minimum  margin  factor  as  indicated  in  Table  4-1 
for  testing  beyond  the  flight  box  envelope,  where  worst-case  demonstration  test  points  are  usually 
defined  beyond  each  corner  of  the  margin  box  (Ml,  M2,  M3,  and  M4  in  Figure  7-1),  with 
alternatives  approved  by  the  Approval  Authority. 

[7. 2.6-2]  Minimum  test  duration  at  a  particular  margin  condition  (e.g.,  high  MR  with  high  thrust,  test  point 
M2  in  Figure  7-1)  shall  be  at  least  10%  of  the  maximum  expected  cumulative  flight  duration 
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(based  on  vehicle  tank  capacity),  unless  confident  analysis  establishes  a  more  appropriate  dwell 
duration,  with  Approval  Authority  concurrence. 

Testing  of  greater  margin  during  development  testing  is  recommended  to  increase  the  likelihood  of 
successful  qualification  testing.  Deliberate  testing  outside  of  the  specification  limits  is  desirable  as  it  helps 
understanding  of  the  engine’s  off-design  performance  and  sensitivities,  but  it  is  recognized  that  significant 
testing  outside  the  specifications  limits  may  pose  unrealistic  conditions  that  are  more  likely  to  damage  the 
engine  hardware  and/or  the  test  facility.  Thus,  specific  test  margin  conditions  should  be  considered 
carefully  to  minimize  unwarranted  risks. 

7.2.7  Ignition  System 

Hot-fire  verification  of  the  ignition  system  includes  demonstration  that  adequate  energy  is  produced  to 
ignite  each  and  all  combustion  devices  reliably,  under  nominal,  off-nominal,  and  worst-case  propellant 
conditions  (including  mixture  ratio,  temperature,  and  pressure),  input  voltage  (if  electronic  excitation  is 
required),  and  hardware  environments  (or  equivalently,  chilldown  conditions).  Worst-case  propellant 
conditions  typically  occur  (for  a  fuel-rich  combustor)  when  a  minimum  amount  of  oxidizer  (low  mixture 
ratio)  is  present  at  the  igniter;  for  cryogenic  propellants  this  typically  occurs  at  minimum  oxidizer  NPSP. 
Very  low  pressure  and  cold  propellants  generally  require  more  available  energy  to  ignite,  so  vacuum 
testing  under  conditioned  environments  is  recommended  for  upper  stage  engines.  Extreme  hardware 
environments  may  exist,  particularly  for  upper  stage  engines  when  multiple  restarts  are  required.  Cold 
propellants  at  high  pressure  may  also  be  difficult  to  ignite  since  more  exciter  power  is  required  to  produce 
a  spark  (i.e.,  Paschens  Law).  Other  factors  that  may  affect  the  amount,  density,  quality,  or  mixture  ratio  of 
propellants  in  the  vicinity  of  the  ignition  location  must  be  considered  and  tested  appropriately  (e.g., 
purges,  known  potential  leaks).  For  hypergolic  ignition  systems,  the  quantity  of  the  hypergol  delivered,  its 
associated  timing  (e.g.,  characteristic  fill  times,  valve  actuation  times),  and  potential  impacts  on 
propellant  delivery  in  the  vicinity  of  the  ignition  location  (e.g.,  purges,  known  potential  leaks)  must  be 
considered  and  tested  appropriately. 

[7. 2.7-1]  The  LRE  qualification  hot-fire  test  shall  verify  reliable  ignition  across  the  range  of  allowed 
conditions  (nominal,  off-nominal,  and  worst-case)  to  include  the  variation  in  fluid  conditions 
(including  mixture  ratio,  temperature,  and  pressure),  chill-down  conditions,  start  transient  timing, 
input  voltage  (if  electronic  excitation  is  utilized),  and  hardware  temperatures. 

[7. 2.7-2]  Testing  of  ignition  systems  used  in  ground  start  engines  shall  take  place  at  sea  level. 

[7. 2.7-3]  Testing  of  ignition  systems  used  in  altitude  start  engines  shall  be  conducted  at  flight-like  vacuum 
levels,  referenced  at  the  location  and  time  of  ignition  in  the  engine. 

[7. 2.7-4]  Tests  for  worst-case  conditions  shall  include  ignition  system  variables  with  margin  beyond 
engine  operational  limits,  as  determined  by  demonstrated  sensitivities  and  heritage.  Large 
margins  near  20%  or  higher  may  be  warranted  where  ignition  sensitivities  exist. 

[7. 2.7-5]  Tests  for  worst-case  conditions  shall  be  conducted  on  a  minimum  number  of  unique  engine 
samples  of  the  flight  design  as  indicated  in  Table  4-2. 

[7. 2.7-6]  Electronic  ignition  shall  address  spark  production  variables  and  delays. 

[7. 2.7-7]  Hypergolic  ignition  systems  shall  address  quantities  and  timing  of  fluid  introduction. 

[7. 2.7-8]  Pyrotechnic  ignition  systems  shall  address  the  pyrotechnic  device’s  loading  and  timing. 
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7.2.8  Turbomachinery 


As  discussed  in  Section  6.3.2,  test-validated  turbomachinery  performance  maps  are  needed  to  predict 
overall  engine  performance.  The  maps  and  performance  predictions  must  consider  the  expected  “3- 
sigma”  operating  band,  potential  further  excursions,  time  varying  performance  over  a  single  burn  and 
over  the  engine’s  life  expectancy,  turbine  and  pump  efficiencies,  NPSP  performance,  turbine  flow  area, 
and  secondary  flows  (bearing  coolant  flows,  thrust  balance  fluid  pressures,  inter-propellant  seal  purges, 
etc.).  Final  verification  of  turbomachinery  maps  and  performance  must  occur  at  the  engine  level. 

[7. 2. 8-1]  LRE  qualification  hot-fire  testing  shall  verify  acceptable  pump  and  turbine  performance  across 
the  entire  range  of  expected  operating  conditions,  including  excursions  and  ground-to-flight 
differences. 

[7. 2. 8-2]  If  variations  in  secondary  flows  are  controllable,  for  example  with  an  orifice  change,  then  they 
shall  be  exercised  during  LRE  qualification  to  identify  sensitivities,  and  if  any  sensitivities  are 
found,  to  demonstrate  adequate  tolerance  against  them. 

[7. 2. 8-3]  LRE  acceptance  hot-fire  testing  shall  verify  acceptable  pump  and  turbine  performance  for  all 
conditions  tested. 

[7. 2. 8-4]  Engines  shall  be  appropriately  instrumented  to  record  the  data  necessary  to  verify  mapping 
information,  efficiencies,  and  engine  performance. 

7.2.9  Combustion  Devices  and  Stability 

Most  performance  characterization  must  occur  on  the  engine  as  it  couples  the  self-induced  environments 
to  combustion  devices.  Transient  priming  and  purging  characteristics  should  be  explored  thoroughly 
(including  nozzle  side -loads).  Gas-ingestion  testing  falls  in  this  category  as  it  has  historically  affected 
combustion  stability  and  performance  (both  steady  state  and  transient),  particularly  in  pressure-fed 
systems.  Bomb  testing  may  be  necessary.  All  operational  power  levels  and  chamber  mixture  ratios, 
including  expected  extreme  variations,  should  be  explored  and  characterized.  Combustion  efficiency, 
injector  pressure  drop,  heat  load/fluxes,  and  coolant  channel  and/or  film  cooling  effectiveness 
characterization  typically  are  analytically  modeled  and  need  validation/anchoring  to  match  steady  state 
performance  predictions.  Testing  of  “powerpack”  type  configurations,  which  typically  includes 
turbomachinery  and  major  combustion  devices  to  test  these  items  in  combination,  may  provide 
supplemental  characterization  prior  to  or  in  parallel  with  the  full  engine  development  test  program. 

[7. 2.9-1]  The  qualification  hot-fire  test  shall  verify  combustion  device  performance  under  nominal,  off- 
nominal,  and  worst-case  propellant  conditions  (including  mixture  ratio,  temperature,  and 
pressure),  chill-down  conditions,  input  voltage  (if  electronic  excitation  is  utilized),  and  hardware 
temperatures.  Specific  performance  metrics  to  be  verified  include  combustion  efficiency,  injector 
pressure  drop,  heat  load/fluxes,  and  coolant  channel  and/or  film  cooling  effectiveness. 

Combustion  stability  must,  in  most  cases,  be  verified  at  the  engine  level.  The  exception  is  when  unit  level 
testing  is  flight-like,  and  its  substitution  is  approved  by  the  Approval  Authority. 

[7. 2.9-2]  Combustion  stability  shall  be  verified  by  engine  test,  or  flight-like  unit  test  with  concurrence  of 
the  Approval  Authority,  using  an  implementation  plan  based  on  the  definition  of  stable  operation 
and  the  test  conditions  listed  within  CPLAC  Publication  655  [4],  and  included  in  the  approved  test 
plan  required  by  [4.2-1], 
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7.2.10  Contamination  and  Debris  Tolerance 


Domestic  and  Foreign  Object  Debris  (DOD/FOD)  can  either  be  self-generated  or  come  from  the  vehicle 
and/or  facility.  It  can  be  introduced  as  residual  after  cleaning  processes,  flowing  propellants,  general 
operations  (functional  check-outs  like  valve  cycling),  or  through  open  interfaces  during  handling. 
Requirements  pertaining  to  contamination  control  aspects  within  an  LRE  are  included  within 
Section  4.7.2  of  SMC-S-005  [2]  (required  per  [4.5.6-1]).  Self-generated  particles  due  to  wear  (e.g.,  gear 
teeth,  turbine  seals)  will  naturally  exist  within  the  system  during  engine  operation. 

Demonstration  of  tolerance  to  self-generated  particles  due  to  wear  (e.g.,  gear  teeth,  turbine  seals)  is  done 
via  the  testing  of  multiple  engines  well  past  the  expected  operational  life.  Testing  and  operational 
procedures  verify  system  maintenance  procedures  are  adequate,  and  manufacturing  and  assembly 
processes  deliver  clean  parts.  It  will  also  verify  that  propellant  quality  and  in-place  filters  are  adequate. 
Inspections  looking  for  significant  FOD/DOD  are  part  of  Sections  7.9. 1  and  7.9.2. 

7.3  Functional  Characteristics 

7.3.1  Cold  Shock  Tests 

Cold  shock  is  normally  performed  upon  initial  integration  of  the  test  facility  and  hardware  to  be  tested. 

[7. 3. 1-1]  Initial  exposure  of  the  LRE  to  cryogenic  propellants  shall  be  followed  by  examination  for  leaks 
and/or  thermal  distortion,  and  inspection  for  material  compatibility  issues. 

7.3.2  Cold  Flow  Tests 

Cold  flow  tests  may  be  performed  at  the  LRE  assembly  level  if  unit  level  testing  (see  [6.4. 1-1])  is 
insufficient  to  meet  the  needs  to  characterize  flow  rates  and  feed  system  pressure  drops,  and  to  verify 
model  results  and  predictions  as  risk  reduction  prior  to  hot-fire.  These  tests  are  most  likely  to  occur  during 
the  development  phase. 

7.3.3  Acceptance  Propellant  Conditions 

Since  the  acceptance  testing  includes  hot-fire  tests,  there  are  opportunities  to  validate  chill-down 
characteristics,  start  and  run  propellant  conditions,  and  shutdown  propellant  conditions.  The  idea  is  not  to 
significantly  vary  conditions,  but  rather  promote  consistency  to  understand  build-to-build  variations  as 
flight  production  continues. 

[7. 3. 3-1]  The  LRE  acceptance  tests  shall  verify  proper  functionality  of  chill-down  systems  including 
tracking  the  flow  rates  and  times  pertaining  to  thermal  conditioning. 

[7. 3. 3-2]  The  LRE  acceptance  test  program  shall  replicate  nominal  vehicle  start  conditions. 

[7. 3. 3-3]  If  an  LRE  has  known  sensitivities  to  changes  in  inlet  pressure,  the  acceptance  test  program  shall 
vary  interface  pressure  to  characterize  engine  behavior  within  run  box  conditions,  whereas  a 
portion  of  the  test  would  be  held  steady  at  defined  standard  conditions  for  performance  tagging. 

[7. 3. 3-4]  The  LRE  acceptance  test  program  shall  maintain  consistent  shutdown  conditions  to  enable  build- 
to-build  and  run-to-run  variation  characterization. 
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7.3.4  Engine  Propellant  Inlet  Conditions 


Through  each  phase  of  operation,  it  is  important  to  characterize  the  propellant  conditions  expected.  Prior 
to  start,  it  is  important  to  thermally  condition  the  engine  hardware  to  minimize  thermal  shock  that  could 
be  detrimental  to  hardware  durability.  LRE  start  transients  are  sensitive  to  propellant  conditions  due  to 
NPSP  sensitivities  on  turbomachinery,  injector  priming,  pressure  variations,  and  two-phase  flow 
associated  with  the  initial  phase  of  stalling  a  cryogenic  engine.  This  carries  over  to  steady  state  where 
inlet  conditions  can  vary  over  time  due  to  stage  propellant  control  systems  and  heat  load  into  the  tank.  At 
the  end  of  burn,  shutdown  propellant  conditions  can  vary  from  the  dominant  part  of  the  burn  due  to  tank 
heat  loads,  ullage  temperature,  and  pressure  control  bands. 

[7. 3.4-1]  LRE  qualification  hot-fire  tests  shall  verify  proper  and  reliable  operation  for  all  propellant 

conditions  at  the  engine  inlet  that  might  be  supplied  by  the  vehicle  in  flight.  Vehicle  feed  systems 
should  be  replicated  as  closely  as  practical  during  propellant  inlet  condition  testing.  Differences 
between  ground  and  flight  feed  systems  should  be  well-understood  through  adequate 
instrumentation  and  modeling. 

Most  vehicles  will  have  a  specification  or  interface  control  document  that  explicitly  describes  the 
expected  and  allowable  propellant  inlet  condition  boxes  that  the  vehicle  propellant  feed  system  must 
deliver  to  the  inlet  of  the  engine.  Such  propellant  inlet  boxes  are  typically  defined  as  regions  within 
prescribed  temperature  and  total  pressure  boundaries.  Further  background  is  provided  in  JANNAF-GL- 
2012-01-R0  [17]. 

Prior  to  start  of  an  LRE,  the  engine  should  be  bled  and  chilled  (cryogenic  engine)  to  eliminate  or 
minimize  vapor,  thermally  condition  the  hardware,  and  achieve  the  specified  engine  inlet  temperature  and 
pressure.  However,  exposure  to  cryogenic  fluids  can  cause  significant  thermal  loads  that  can  damage 
hardware  if  not  performed  properly. 

[7. 3.4-2]  LRE  qualification  hot-fire  tests  shall  verify  the  prestart  chill-down  and  other  conditioning 

procedures  intended  for  prelaunch  and  flight  operations  through  characterization  of  proper  chill- 
down  system  operation  (e.g.,  flow  rates,  temperatures,  valve  operations),  acceptable  hardware 
thermal  condition  variability  (i.e.,  temperature  versus  flow  rate  over  time),  and  acceptable 
hardware  temperatures  prior  to  start. 

[7. 3.4-3]  LRE  qualification  hot-fire  tests  shall  include  minimum,  nominal,  and  maximum  chill-down 
pressures,  temperatures,  and  flow  rates,  including  worst  case  combinations  (e.g.,  minimum 
chilldown  duration  and  flowrates  with  maximum  predicted  initial  temperature)  while  verifying 
that  hardware  temperatures  meet  requirements  prior  to  engine  start. 

[7. 3.4-4]  Testing  of  chill -down  used  in  altitude  start  engines  shall  be  conducted  at  flight-like  vacuum 
levels,  or  in  simulated  conditions  that  can  be  demonstrated  as  bounding,  or  sufficiently 
representative,  of  flight  conditions. 

While  chill-down  covers  the  conditions  when  the  hardware  is  thermally  conditioned,  start  propellant  inlet 
conditions  refers  to  the  small  window  that  holds  conditions  in  the  “start  box”  where  the  tanks  are 
pressurized  to  start  pressures.  The  start  box  (see  also  Section  7.3.5)  tends  to  reside  within  the  “run  box,” 
which  is  related  to  steady  state  propellant  conditions. 

[7. 3.4-5]  LRE  qualification  hot-fire  tests  shall  verify  successful  starts  with  inlet  conditions  throughout  the 
“start  box,”  including  propellant  feed  pressure  “slump”  (from  feed  system  inertance  and 
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resistance),  possible  variation  in  local  temperature  conditions  due  to  low  circulation  flow  rates 
and  feedline  heat  loads,  and  the  relative  operating  boxes  of  various  ancillary  systems  of  the  LRE. 

Typically  there  is  no  similar  “shutdown  box.”  Instead,  it  is  generally  expected  that  the  LRE  can  perform  a 
safe  shutdown  (see  also  Section  7.3.5)  from  any  conditions  throughout  the  “run  box.”  Engine  and  vehicle 
performance,  as  well  as  engine  durability,  can  be  very  sensitive  to  MR,  and  shutdown  MR  can  be  very 
sensitive  to  end  of  burn  propellant  tank  conditions,  so  tolerance  to  expected  MR  variation  is  important. 

[7. 3.4-6]  LRE  qualification  hot-fire  tests  shall  characterize  shut-down  behavior  throughout  the  “run  box,” 
unless  otherwise  restricted,  including  expected  end-of-burn  mixture  ratio  variation  and  ancillary 
system  conditions. 

7.3.5  Transient  Characterization 

Transients  are  critical  to  explore  during  the  development  of  a  rocket  engine  as  they  affect  hardware 
durability,  analytical  modeling,  and  interactions  between  components/subsystems.  Significant  effort 
should  be  spent  characterizing  the  variations  that  could  occur  during  any  given  flight  by  varying 
propellant  conditions  (primary  and  secondary)  and  valve  command  timing. 

7.3.5.1  Start  Transients 

Start  transient  modeling  is  a  significant  portion  of  the  hardware  design  criteria.  This  modeling  must  be 
physics-based  to  best  represent  the  predicted  hardware  characteristics.  Testing  must  validate  and  anchor 
the  start  transient  model,  similar  to  that  done  for  the  steady  state  performance  models. 

[7. 3.5-1]  LRE  qualification  hot-fire  testing  shall  verify  that  the  final  startup  sequence  produces  a  start 
transient  that  satisfies  all  requirements,  including  under  all  expected  variations  in  regards  to 
propellant  conditioning  and  associated  inlet  start  conditions  (both  primary  and 
secondary/ancillary),  hardware  thermal  conditioning,  electric  power,  valve  command  timing, 
ignition  timing,  valve  slew  rates,  flow  orifices,  and  ambient  conditions. 

[7. 3.5-2]  LRE  qualification  start  transient  testing  shall  include  margin  beyond  worst-case  conditions, 
established  upon  the  criticality  of,  and  sensitivity  to,  start  characteristics  determined  from 
specification  requirements,  development  testing,  and  validated  modeling,  where  treatment  of 
worst-case  conditions  considers  various  factors  as  applicable,  including  bootstrap  rates  (e.g.,  fast 
and  slow),  available  start  energy  versus  resistances  (e.g.,  turbomachinery  stalling  torque  margin), 
and  severity  of  thermal  transients. 

[7. 3.5-3]  LRE  qualification  start  transient  test  data  shall  be  used  to  accomplish  the  following: 

a.  Verify  thermal  conditioning  process  simulations; 

b.  Develop  forcing  functions  for  structural  dynamics  loads  analyses; 

c.  Define/validate  control  valve  timing; 

d.  Establish  purge  system  schemes,  timing,  and  flow  rates  (e.g.,  to  mitigate  potential 
reverse  flow  and/or  determine  acceptable  limits); 

e.  Determine  ignition  overpressure  (IOP)  and  structural  loads  environment; 

f.  Establish  effective  start  commit  criteria  (SCC)  and  launch  commit  criteria  (LCC). 

[7. 3.5-4]  LRE  qualification  start  transient  verification  tests/evaluations  shall  include  the  following: 

a.  Verify  specification  limits  are  met; 
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b.  Verify  acceleration  rates,  flow  rates,  propellant  consumption,  and  side  forces  are 
acceptable; 

c.  Validate  initial  spin-up  and/or  bootstrap  method  (if  applicable). 

[7. 3.5-5]  LRE  acceptance  testing  shall  include  (at  least  at  nominal  or  standard  conditions)  start  transient 
characterization,  and  a  comparison  against  qualification  data  to  ensure  it  is  within  family. 

7.3. 5.2  Restart  Transients 

Depending  upon  the  mission  usage  role,  some  engines  may  be  restarted  one  or  more  times  during  flight;  if 
restart  is  required,  it  must  be  properly  verified. 

[7. 3.5-6]  For  LRE  whose  concept  of  operations  includes  restart  in  flight,  qualification  hot-fire  testing  shall 
verify  restart  capability  at  nominal,  off-nominal,  and  worst-case  (with  margin)  conditions  (actual 
or  simulated),  to  include  such  effects  as  heat  soak  back,  propellant  settling,  and  propellant  slosh. 

7. 3.5.3  Throttle  Transients 

Some  engines  are  intended  to  operate  with  continuous  throttling  capability  or  multiple  steady  state  power 
levels.  For  these,  test  demonstration  should  characterize  throttle  rates  and  control  capability  during  the 
intended  continuous  throttling  periods  and/or  transitions  between  the  specific  intended  discrete  steady 
state  power  levels,  according  to  specification  requirements  and  expected  operation.  Throttle  transient 
characterization  testing  may  be  incorporated  into  tests  with  other  objectives. 

[7. 3.5-7]  For  LREs  intended  for  continuous  throttling  or  multiple  discrete  steady-state  power  levels, 

qualification  hot-fire  testing  shall  characterize  engine  throttle  transients,  including  all  specified 
and  expected  throttle  rates,  power  level  transitions,  and  control  capability,  while  simulating 
relevant  external  flight  influences  (e.g.,  rapid  inlet  pressure  changes  due  to  acceleration  changes). 

[7. 3.5-8]  For  LREs  intended  for  continuous  throttling  or  multiple  discrete  steady  state  power  levels, 

acceptance  hot-fire  testing  shall  characterize  engine  throttling  behavior  to  thoroughly  exercise  the 
control  systems,  verify  specification  requirements  and  expected  operation,  and  compare  behavior 
to  the  production  family. 

7. 3. 5.4  Shutdown  Transients 

The  desire  is  for  repeatable  shutdown  transient  response  to  ensure  structural  integrity  and  aid  flight 
control.  Like  the  start  transient  and  steady  state  performance  models,  testing  must  anchor  shutdown 
transient  models. 

[7. 3.5-9]  LRE  qualification  hot-fire  testing  shall  characterize  a  baseline  shutdown  sequence  in  regard  to 
impulse  ranges  and  repeatability. 

[7.3.5-10]  LRE  qualification  hot-fire  testing  shall  verify  the  final  shutdown  sequence,  including  the  range 
of  expected  variations  in  regards  to  power  level  conditions,  propellant  inlet  conditions,  mixture 
ratio,  repressurization  flows,  purges,  hardware  thermal  conditions  (cold  versus  hot  components), 
and  control  system  parameters  (e.g.,  voltage,  pressure,  valve  timing,  valve  slew  rates,  and  flow 
orifices).  Additional  scrutiny  is  expected  for  the  combinations  that  produce  the  slowest  and  fastest 
shutdown  transient. 
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Tests  for  worst-case  conditions  should  include  program-specific  margins.  The  actual  margin  values  are 
dependent  on  the  type  and  application  of  engines  being  tested.  These  values  should  be  determined  during 
development  testing,  be  in  compliance  with  specification  requirements,  and  be  tailored  to  the  specific 
engine  system  being  tested. 

[7.3.5-11]  LRE  qualification  and  acceptance  hot-fire  testing  of  the  shutdown  sequence  shall  verify  that 

deceleration  rates,  flow  rates,  propellant  consumption,  shutdown  impulse,  impulse  repeatability, 
and  side  forces  are  acceptable,  and  that  spin-down  rates  and  dynamic  responses  (e.g.,  chugging, 
“pops”)  are  within  allowable  limits. 

7. 3.5.5  Abort  Shutdown  Transients 

Abort  scenarios  vary  widely  from  vehicle  to  vehicle  and  the  stage  for  which  the  engine  is  designed. 
Complex  systems  tend  to  fail  in  complex  ways,  therefore  modeling  all  possible  abort  shutdown  scenarios 
is  rather  difficult.  Failure  Modes  and  Effects  Analysis  (FMEA)  and  other  hazards  documentation  should 
be  examined  at  all  levels  to  best  understand  the  reasonable  failure  modes  to  test  and  evaluate.  The  test 
program  should  incorporate  some  testing  of  abort  scenarios  to  better  anchor  models  that  can  be 
extrapolated  to  satisfy  safety  concerns. 

[7.3.5-12]  LRE  qualification  hot-fire  testing  shall  verify  the  ability  to  safely  abort  and  shutdown  while  on 
the  pad  using  launch  site  abort  logic  and  shutdown  procedures,  with  interfaces  simulating  those  of 
the  launch  environment,  including  demonstration  of  planned  post-abort  safing,  inspections,  and 
turnaround  activities. 

7.3.6  NPSP  Margin  and  Cavitation 

As  detailed  in  Section  6.4.3,  NPSP  is  the  pressure  difference  between  the  total  pressure  and  vapor 
pressure  of  a  liquid  propellant  at  a  given  temperature.  For  engines  with  liquid  pumps,  this  is  a  key 
parameter  to  quantify  what  is  known  as  suction  performance.  This  parameter  must  be  thoroughly 
understood  and  characterized.  Low  inlet  pressure  to  a  pump  can  lead  to  significant  cavitation  which  can 
reduce  pump  performance  with  corresponding  reduced  discharge  pressure  (commonly  referred  to  as  head 
fall-off)  and  may  damage  or  fail  hardware.  Lower  tank  operating  pressures  for  vehicle  systems  are 
desirable  to  reduce  tank  weight,  but  a  minimum  NPSP  must  be  maintained  to  avoid  significant  pump 
cavitation.  The  margin  is  analytically  predicted,  along  with  the  turbopump  performance  maps  anchored  to 
test  data,  and  incorporated  into  engine  steady  state  performance  and  transient  models. 

Pump  conditions,  over  the  engine  operating  range,  should  be  mapped  in  terms  of  the  dimensionless  pump 
parameters  which  govern  cavitation  behavior,  namely  cavitation  number  and  flow  coefficient,  accounting 
for  uncertainties  derived  from  measurement  uncertainties,  hardware  variation,  and  ground-to-flight 
differences.  Operating  excursions  on  the  full  engine  and/or  powerpack  (if  flight  representative)  are 
required  to  validate  and  verify  adequate  performance  and  reliable  operation,  although  this  may  be 
supplemented  by  information  obtained  from  component-level  testing  (Section  6.4.3).  The  core 
requirements  of  this  section  are  identical  to  Section  6.4.3,  with  the  addition  of: 

[7. 3.6-1]  Any  conditions  not  verified  at  the  engine  level  shall  be  adequately  explored  at  the  component 
level  (Section  6.4.3). 

[7. 3.6-2]  If  there  are  significant  unit-to-unit  variations  in  any  important  cavitation  characteristics  (e.g., 
strength  or  operating  parameter  range),  then  LRE  acceptance  hot-fire  testing  shall  verify 
acceptable  pump  performance  and  environments  for  the  most  pronounced  cavitation  conditions  as 
identified  during  qualification. 
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A  separate  NPSP  margin  demonstration  test  is  recommended  for  each  propellant  (rather  than 
simultaneous  margin  testing  on  multiple  propellants)  to  reduce  risk  of  system  interactions  and  potential 
over  test  conditions.  Test  durations  at  the  minimum  NPSP  condition  should  be  sufficiently  long  to  collect 
steady  state  data.  Also,  the  minimum  NPSP  test  point  should  be  sufficiently  low  to  collect  data  that 
explores  the  impact  of  potential  single  point  system  failures  (e.g.,  failed  pressurization  branch),  but 
generally  not  much  lower  than  the  2%  head  falloff  region.  Actual  margin  values  should  consider 
development  testing  results  and  the  type  of  engine  being  tested. 

7.3.7  Pogo  and  Pump  Compliance  Characterization 

Pogo  is  a  fluid-structural  instability  that  can  cause  catastrophic  loss  of  a  vehicle.  Characterization  of 
engine  compliance  by  testing  becomes  an  important  part  of  anchoring  the  analytical  models  and  helps 
determine  if  a  suppressor  is  required.  Suppressors  can  be  engine-mounted  or  stage-mounted. 

Only  engine  testing  can  offer  an  environment  that  sufficiently  simulates  vehicle  provided  inlet  conditions. 
Verification  of  the  pogo  model  of  engine  oscillatory  behavior  requires  special  engine  testing  to  determine 
frequency  response  functions  over  the  full  range  of  engine  operating  conditions.  These  frequency 
response  functions  express  the  amplitude  and  phase  of  engine  inlet,  pump  discharge,  and  Pc  versus 
frequency  per  unit  of  sinusoidal  flow  oscillation  inserted  upstream  of  the  engine  inlet.  This  testing  is 
applied  to  each  propellant  circuit  that  remains  liquid  up  to  the  main  injector,  such  as  LOX  or  a  kerosene¬ 
like  propellant.  Testing  for  liquid  hydrogen  is  not  required  because  gasification  occurs  upstream  of  the 
main  injector. 

Ideally,  the  overall  test  feed  system  should  include  a  replication  of  the  flight  feed  system,  or  as  close  as 
practical.  The  upstream  facility  system  should  be  dynamically  decoupled  from  the  flight  representative 
feed  system  by  using  an  isolation  accumulator  to  create  a  dynamic  pressure  null  at  the  accumulator 
position.  A  pre-test  dynamic  model  of  the  overall  test  system  should  be  created  and  the  design 
requirements  for  the  facility  accumulator  determined. 

Special  pressure  instrumentation  should  be  included  with  data  acquisition  ranged  to  accurately  determine 
small-amplitude  oscillations  in  the  frequency  range  of  interest.  The  pump  inlet  pressure  amplitude  should 
be  intentionally  kept  below  a  few  psi  to  ensure  that  its  dynamic  response  is  linear  with  amplitude.  The 
downstream  pressure  amplitudes  are  normally  smaller  than  the  inlet  pressure.  After  determining  the 
frequency  responses  by  test,  parameters  of  the  test  system  dynamic  model  should  be  adjusted  to  best 
match  the  test  data.  The  paramount  parameters  to  be  verified  are  pump  cavitation  compliance  and  pump 
gain  as  a  function  of  cavitation  index  and  flow  coefficient  at  the  pump  inlet. 

[7. 3.7-1]  LRE  qualification  hot-fire  testing  (or  development  testing  with  flight-design  hardware)  shall  be 
used  to  determine  pump  compliance  and  pump  gain,  as  a  function  of  cavitation  index  and  flow 
coefficient  at  the  pump  inlet,  to  facilitate  vehicle  pogo  modeling  with  parameters  derived  using 
pogo  pulse  testing  and  analytical  modeling. 

[7. 3.7-2]  If  engine-mounted  pogo  suppressor  hardware  is  used,  the  majority  of  LRE  qualification  hot-fire 
testing  shall  be  performed  with  the  pogo  suppressor  hardware  installed  and  operating  as  designed 
during  flight. 

7.3.8  Ancillary  Systems 

Ancillary  subsystems  are  secondary  systems  (mechanical,  hydraulic,  pneumatic,  and  electrical 
subsystems)  that  make  the  engine  function  as  it  is  intended.  Typically  all  functions  are  necessary  in  these 
systems  and  are  no  less  significant  than  the  primary  flow  path  items.  These  systems  tend  to  make  up  the 
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majority  of  the  interfaces  with  the  stage.  Just  as  the  primary  propellants,  there  are  operating  boxes  defined 
for  each  ancillary  system.  Either  coming  from  or  going  to  the  stage,  the  ancillary  systems  influence 
performance  and  functionality  of  the  engine. 

[7. 3. 8-1]  Each  ancillary  system  operational  band  within  an  LRE  shall  be  characterized  in  qualification  hot- 
fire  testing.  Flight-like  component-level  testing  may  be  substituted  if  it  is  impractical  to  test  the 
full  range  of  values  on  the  LRE. 

Autogenous  pressurization  is  when  a  small  amount  of  the  primary  propellant  is  heated,  expanded,  and 
then  returned  to  the  vehicle  to  be  used  for  tank  pressurization.  Inert  gases  may  also  be  used  to  pressurize 
tanks. 

[7. 3. 8-2]  LRE  qualification  hot-fire  testing  shall  verify  autogenous  and  inert  gas  pressurization 

requirements  and  determine  the  influence  on  engine  operation  using  nominal  and  worst-case 
engine  operating  conditions  with  margin  on  flow  rates.  The  appropriate  margin  value  for  flow 
rates  is  dependent  on  the  type  and  application  of  the  system. 

Variations  in  ancillary  systems’  functional  parameters  can  affect  engine  performance.  For  example, 
variations  in  conditions  for  valve  actuation  directly  affect  repeatability  of  start  and  shutdown  transient 
characteristics,  so  efforts  would  be  justified  to  vary  working  fluid  temperatures  and  pressures  to  the 
maximum  and  minimum  values,  to  characterize  engine  transient  behavior  over  those  extremes. 

[7. 3. 8-3]  LRE  qualification  hot-fire  testing  shall  verify  that  electrical,  pneumatic,  and  hydraulic 

operational  box  minimums  and  maximums  do  not  significantly  affect  engine  or  stage  operation, 
or  if  they  do,  that  effects  are  well  understood  and  acceptable.  Flight -like  component-level  testing 
may  be  substituted  if  it  is  impractical  to  test  the  maximum  and  minimum  values  on  the  LRE. 

Purging  ensures  the  engine  remains  clean  prior  to  operation  (prevents  contaminants  from  entering),  and 
inerts  the  engine  at  the  end  of  operation  (expels  remaining  propellants).  Proper  sequencing  and  flowrates 
are  key  to  start  and  shutdown  characteristics  of  the  engine. 

[7. 3. 8-4]  LRE  qualification  testing  shall  develop  the  appropriate  purge  schemes,  flow  rates,  and  timing. 

[7. 3. 8-5]  LRE  qualification  hot-fire  testing  shall  validate  purge  effectiveness  using  dew  point 

measurements  or  other  appropriate  means  at  minimum,  nominal,  and  maximum  purge  flow  rates, 
temperatures,  and  pressures  for  operational  sequences  and  abort  situations. 

Electrical  power  tends  to  be  supplied  by  the  stage/vehicle.  These  systems  have  power  quality 
requirements.  Engine  electrical  systems  include  the  engine  controller,  data  systems,  valve  control,  and 
ignition  systems.  Variations  in  power  quality  can  have  detrimental  effects  to  engine  functionality. 

[7. 3. 8-6]  LRE  testing  shall  verify  electronics,  including  end-to-end  checkouts  and  valve  sequence 
checkouts,  prior  to  hot-fire. 

7.3.9  Thrust  Vector,  Gimballing,  and  Deployment 

Thrust  vector  control  (TVC)  includes  engine  gimbal  and  roll  control  systems,  or  differential  throttling  in 
non-conventional  configurations  such  as  aerospike  engines.  Engine  nozzles  may  also  be  configured  with 
deployable  elements  prior  to  flight  usage.  Vehicle  interfaces  should  be  simulated  as  close  as  possible  to 
the  flight  design,  including  the  stiffness  at  attach  points  when  testing  these  elements.  If  vehicle  structural 
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components  (e.g.,  heat  shields,  boots,  or  a  boat  tail)  are  significant  in  defining  the  interfaces  or  clearances, 
then  those  components  should  also  be  included  or  simulated. 

[7. 3.9-1]  LRE  qualification  testing  shall  verify  that  TVC,  gimballing,  or  other  deployment  functional 

capability  meets  system  requirements  including  maximum  control  range,  slew  rate,  acceleration, 
loads,  and  frequency  response. 

[7. 3.9-2]  LRE  qualification  hot-fire  testing  shall  include  tests  at  worst-case  combination  propellant 

conditions  for  loading  of  TVC,  gimballing,  or  deployment  mechanisms,  and  at  minimum  and 
maximum  thrust  levels. 

[7. 3.9-3]  LRE  qualification  hot-fire  testing  shall  include  tests  with  the  engine  or  chamber  (as  appropriate) 
gimbaled  to,  and  functionally  operated  at,  its  limit  positions,  slew  rates,  and  accelerations. 

[7. 3.9-4]  LRE  qualification  non-fire  testing  of  girnbal  elements  shall  include  functional  and  hardware 
clearance  checks. 

[7. 3.9-5]  LRE  qualification  testing  of  girnbal  elements  shall  include  functional  operation  of  roll  control 
elements  (if  applicable)  at  limit  positions  during  non-firing  testing,  and  during  hot-fire  testing. 

[7. 3.9-6]  LRE  qualification  testing  of  TVC  and  deployment  mechanisms  shall  be  at  the  appropriate 

altitude  environment  (sea  level  and/or  vacuum).  Component  qualification  of  vacuum  sensitive 
TVC  and  deployment  mechanism  elements  may  be  used  in  place  of  LRE  test  verification. 

[7. 3.9-7]  LRE  qualification  testing  of  TVC  and  deployment  mechanisms  shall  verify  that  the  engine 

induced  heat  flux  on  adjacent  surfaces  during  hot-fire  TVC  testing  is  within  acceptable  limits. 

[7. 3.9-8]  LRE  qualification  testing  of  TVC  and  deployment  mechanisms  shall  validate  the  engine  envelope 
clearance  analyses  at  limit  positions.  The  recommended  clearance  under  dynamic  conditions,  and 
with  flight  conditions  applied,  is  1.0  inches  (25.4  mm).  Smaller  clearances  may  be  considered 
acceptable  upon  review  of  the  uncertainties  associated  with  the  analysis  of  the  differences  in  the 
ground  to  flight  clearances. 

[7. 3.9-9]  LRE  qualification  testing  of  TVC  and  deployment  mechanisms  shall  verify  girnbal  block  and  roll 
control  (if  applicable)  interface  compatibility  for  mechanical  (e.g.,  bearings),  hydraulic,  and 
electrical  connections  under  minimum  and  maximum  control  parameters. 

[7.3.9-10]  LRE  qualification  testing  of  TVC  and  deployment  mechanisms  shall  verify  thrust  vector 
alignment  characteristics  (arc  minutes  and  offset)  utilizing  thrust  measurement  systems  with 
lateral  measurement  capability. 

Dry,  ambient  hardware  conditions  can  be  used  to  check  functionality  of  systems  and  fits/clearances  of 
hardware.  Hot-fire  conditions  can  be  used  to  help  check  proper  TVC  maximum  control  range  at  expected 
slew  rates,  accelerations,  loads,  and  frequency  response. 

Acceptance  testing  of  TVC  or  roll  control  actuators  on  the  engine  is  not  required  if  the  unit  level 
acceptance  testing  is  robust.  It  may  be  preferred  to  include  such  units  in  engine -level  testing  for 
acceptance,  particularly  if  the  actuators  are  supplied  by  the  engine  manufacturer. 

[7.3.9-11]  LRE  acceptance  testing  shall  measure  thrust  vector  alignment  during  hot-fire. 
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7.4  Structural  Tests 


Whenever  feasible,  structural  verification  of  LRE  components  should  be  performed  at  the  unit  level,  as  it 
is  often  challenging  to  apply  these  loads  at  the  engine  level.  An  engine  structural  test  consists  of  an 
ultimate  load  applied  at  the  engine-level. 

[7.4-1]  Engine  structural  tests  shall  be  performed  on  engine  components  that  were  not  subject  to  unit-level 
ultimate  load  tests. 

[7.4-2]  Interface  loads  and  relevant  loads  acting  on  the  engine  (e.g.,  actuators,  etc.)  shall  be  simultaneously 
applied  to  an  engine  test  sample,  equivalent  to  flight  design,  to  the  ultimate  MDCL. 

[7.4-3]  Detrimental  deformation  of  the  LRE  shall  not  occur  at  the  proof  factor  times  MDCL  (e.g., 
excessive  yielding  leading  to  thrust  angle  change). 

Fatigue  verification  at  the  LRE  level  is  accomplished  by  the  performance  and  functional  testing  using  the 
margin  factors  specified  in  Section  7.7. 

7.5  Pressure  and  Leak  Testing 

Proof  and  burst  pressure  testing  are  not  performed  at  the  engine  level  due  to  the  large  pressure  gradients 
throughout  the  engine  during  operation.  Proof  and  burst  testing  are  reserved  for  the  unit  level  as  a  part  of 
manufacturing  and  assembly  (see  Section  6.1 1).  Analytical  verification  of  pressure  capability  of  the  LRE 
is  within  Section  5.3. 

Leakage  checks  are  conducted  to  ensure  that  the  system  will  not  leak  beyond  its  specified  limits  during 
pre -launch  and  flight/operation.  There  are  various  ways  to  perform  leak  tests  and  there  may  be  different 
approaches  at  different  locations  across  the  engine  depending  upon  hardware  configuration  and  operating 
pressures. 

Leakage  tests  of  the  LRE,  including  all  pressurized  systems  such  as  pneumatics  and  hydraulics  within  the 
LRE,  are  part  of  compliance  to  SMC-S-005  [2]  within  Section  4.7.2  of  that  document  (see  [4.5. 6-1]  of  this 
Standard).  The  method  used  to  detect  and/or  measure  leakage  is  purposely  left  unspecified  within  SMC-S- 
005  [2]  and  is  expected  to  be  set  by  the  program  as  applicable. 

7.6  Environments 

Natural  and  induced  environments  are  key  factors  in  the  design  of  hardware.  This  section  outlines  the 
tests  necessary  to  validate  analytical  models  used  to  define  induced  environments,  and  to  verify 
compatibility  with  natural  environments  under  both  operating  and  non-operating  conditions. 

Environmental  testing  investigations  are  done  during  development  and  qualification.  However,  some 
level  of  screening  is  incorporated  into  the  acceptance  test  series,  even  if  it  is  not  a  specific  objective 
during  engine  hot-fire.  Accelerometers,  strain  gages,  skin  temperatures,  etc.,  are  all  utilized  to 
characterize  each  engine  build’s  response.  Engine  environments  during  hot-fire  operation  are  typically  the 
most  extreme  environments  on  engine  hardware. 

Hot-fire  test  is  a  valuable  screen  for  hardware  acceptance,  but  this  does  not  justify  elimination  of  the 
component  ATP;  rather,  engine  hot-fire  acceptance  is  additive.  For  upper  stage  or  in-space  propulsion, 
there  are  other  significant  and  unique  environments  that  exist,  driving  design  features  that  need  additional 
testing  over  and  above  engine  hot-fire.  Many  times,  the  engine  hot-fire  can  still  serve  as  a  useful 
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screening  environment.  Engine  environments  should  be  appropriately  measured  during  acceptance  for 
comparison  back  to  test  experience. 

7.6.1  Thermal  Environment 

The  SMC-S-016  [1]  requirement  for  a  thermal  vacuum  test  of  bus  subsystems  is  replaced  by  hot-fire 
testing  of  the  LRE.  Thermal  environments  of  the  LRE  are  initially  modeled  at  various  levels.  Vehicle 
analysis  flows  down  natural  and  vehicle-induced  environments  to  its  constituents. 

[7. 6. 1-1]  LRE  qualification  shall  include  an  analytical  thermal  model  including  natural,  vehicle-induced, 
and  self-induced  thermal  environments  from  expected  engine  operation  for  all  phases  of 
operation. 

[7.6. 1-2]  The  LRE  thermal  model  shall  be  validated  against  test  data  using  thermocouples,  resistive 

temperature  devices  (RTDs),  and  skin  temperatures  to  convey  the  thermal  profile  of  the  engine, 
with  the  goal  of  agreement  within  ±6°C  (±10°F)  for  steady  state  conditions,  and  ±1 1°C  (±20°F) 
for  transient  conditions. 

7.6.2  Climatic  Tests 

The  engine  must  be  robust  against,  or  adequately  protected  against,  expected  exposure  to  salt,  fog,  sand, 
and  dust.  This  requirement  is  handled  at  the  unit  level  (see  [6.10-1])  although  testing  may  be  performed  at 
higher  levels  of  assembly  to  verify  capability. 

7.6.3  Vibration,  Shock,  and  Acoustics 

Space  launch  vehicles  experience  severe  vibration  environments  during  liftoff,  atmospheric  ascent,  and 
space  flight  that  can  impose  substantial  dynamic  loads  on  vehicle  components  and  payloads.  LREs  also 
experience  self-induced  vibration  environments  inherent  to  the  high-speed  high-power  turbomachinery, 
high  flow  rate  fluids,  and  complex  combustion  devices  utilized. 

[7. 6. 3-1]  LRE  qualification  testing  (or  analysis,  where  impractical  to  test)  shall  address  all  applicable 
dynamic  environments,  including  the  external  excitation  requirements  of  SMC-S-016  [1],  and 
engine  self-induced  vibration,  followed  by  functional  test  and  hot-fire  of  the  LRE  in  a  flight 
simulation  to  verify  acceptable  performance. 

Traditional  methods  can  be  used  to  qualify  engine  hardware  for  external  environments  induced  during 
non-operating  phases  of  flight  (e.g.,  boost  phase  loads  on  an  upper  stage  engine).  The  appropriate  test 
requirements  are  described  in  SMC-S-016  [1].  Qualification  of  vehicle  components  or  subsystems  for 
external  excitation  environments  is  typically  achieved  by  affixing  the  test  article  to  a  shaker  table  and 
exposing  it  to  a  pre-determined  dynamic  environment  that  replicates  or  exceeds  the  expected  flight 
environment.  Predicted  environments  usually  are  derived  from  flight  data.  They  are  simulated  by  an 
equivalent  base-shake  input,  generally  stationary  random  or  sine  dwell  excitation,  that  induces  dynamic 
loads  in  the  component  at  frequencies  and  amplitudes  consistent  with  expected  operational  loads.  In  this 
manner,  the  test  article  is  subjected  to  fatigue  damage  potential  equivalent  to  that  experienced  by  the 
flight  hardware.  The  duration  of  exposure  required  to  adequately  demonstrate  durability  is  determined 
based  on  margin  requirements  and  SL  (including  acceptance  testing  and  flight  duration). 

In  cases  where  LRE  environments  are  dominant,  on-engine  qualification  may  be  performed  as  a 
demonstration  of  design  robustness  for  LRE  components.  For  some  component  types  (typically  more 
complex  components  involving  sensitive  electronics),  it  is  necessary  to  demonstrate  design  margin  with 
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respect  to  LRE  vibration  and  shock  amplitude  in  addition  to  fatigue.  If  amplitude  margin  cannot  be 
applied  in  a  straightforward  manner  at  the  LRE  level,  shaker  table  testing  at  the  component  level  is 
recommended  in  these  circumstances.  It  is  necessary  to  account  for  allowable  component  acceptance 
vibration  testing  when  considering  appropriate  qualification  margin  and  duration.  Component  test 
requirements  should  be  derived  from  LRE  accelerometer  data  acquired  during  engine  level  testing.  If  data 
for  the  configuration  in  question  are  not  available,  then  analysis  or  scaling  of  data  from  a  similar  LRE 
configuration  may  be  utilized. 

Determination  of  self-induced  vibration  will  necessitate  the  engine  turbopump  and  other  critical 
components  being  instrumented  with  accelerometers  to  characterize  the  dynamic  environment  during  the 
development  and  qualification  program.  The  resulting  accelerometer  test  data  represent  the  qualified 
environment  for  self-induced  engine  vibration.  Self-induced  environments  for  LREs  can  be  quite  severe 
and  are  highly  complex,  often  including  a  large  number  of  discrete  frequency  and  narrow  band  random 
excitations  spanning  a  wide  frequency  range.  It  is  highly  recommended  that  narrowband  spectral  analysis 
be  applied  to  known  LRE  self-induced  discrete  forcing  functions,  given  their  narrowband  nature. 
Additional  analysis  and  consideration  of  forcing  function  characteristics  should  be  utilized  in  determining 
whether  the  resulting  environment  is  sinusoidal  or  random.  During  subsequent  hot  fire  testing  and  flight, 
in  the  event  of  an  out-of-family  observation  at  a  critical  accelerometer  location! s),  an  assessment  would 
be  performed  to  (1)  determine  the  cause  of  the  observation,  (2)  quantify  the  sensitivity  of  the  engine 
design  to  the  observation,  and  (3)  evaluate  any  potential  degradation  of  design  margins. 

[7. 6. 3-2]  LRE  qualification  testing  shall  include  extended  duration  engine  operation  (per  Table  4-1)  under 
operating  conditions  representative  of  production  acceptance  and  flight  to  verify  durability  of  the 
engine  hardware  to  self-induced  vibration. 

7.6.4  Vehicle  Interface  Loads 

Vehicle-to-engine  interfaces  have  a  combined  fluid-structural  response  characteristic.  Significant 
structural  loading  is  transferred  from  the  engine  to  the  stage/vehicle  at  the  primary  thrust  take-out  points 
(i.e.,  through  a  gimbal  bearing  or  other  thrust  structure).  At  the  other  interfaces  there  can  be  fluid  loading 
from  propellant  flow,  secondary  structural  loading,  and  mechanical  loading  from  gimballing.  All  these 
conditions  are  to  be  taken  into  account  for  engine  models,  and  then  flowed  to  component  level  designers 
for  detailed  design.  These  models  need  anchoring  from  engine  testing  for  engine  generated  loadings. 

[7. 6.4-1]  LRE  qualification  testing  shall  verify  interface  environments  are  within  the  Maximum  Predicted 
Environments  (MPE)  by  characterizing  frequencies  and  amplitudes  at  the  interfaces  during 
engine  testing. 

7.6.5  Electromagnetic  Compatibility  Tests 

Electronics  are  critical  elements  of  flight  systems  which  depend  upon  these  items  to  control  and  manage 
engine  functionality  (engine  health  and  status,  valve  controls,  data,  etc.). 

[7. 6.5-1]  LRE  qualification  shall  verify  conformance  of  all  electrical  components  to  the  EMC 
requirements  within  SMC-S-016  [1]. 

In  addition,  ordnance,  deployment  systems,  and  fuel  systems  should  be  protected  from,  or  made 
impervious  to,  inadvertent  activation  due  to  high  electric  field  strengths,  electrostatic  discharge  (ESD), 
and  lightning.  Specific  EMC  requirements  should  be  made  more  stringent,  if  necessary,  to  verify 
acceptability  for  the  worst-case  inclement  weather  allowable  for  the  launch.  In  addition,  fuel  lines  need  to 
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have  low  enough  resistivity  and  adequate  bonding  to  surrounding  structures  to  avoid  surface  electrostatic 
charging  and  discharge. 

7.7  Life 

Qualification  of  an  engine  for  flight  includes  showing  margin  against  each  operating  condition  utilized 
over  the  service  life.  This  is  one  aspect  of  demonstrating  hardware  robustness.  The  intention  is  to  show 
this  on  multiple  engines  throughout  the  DDT&E  program  to  build  confidence  in  manufacturing  processes 
and  build-to-build  variation. 

7.7.1  Operational  Lifetime  and  Durability 

In  verifying  lifetime  capability,  the  engine  cannot  merely  be  fired  at  one  particular  operating  condition  to 
accumulate  a  total  duration.  Duration  with  appropriate  margin  is  applied  on  all  expected  operating 
conditions  to  the  extent  practical.  Higher  test  margins  during  earlier  development  are  recommended  to 
provide  greater  confidence  of  success  going  into  verification  testing.  Any  tailoring  and/or  exceptions 
must  be  dispositioned  and  properly  justified. 

[7. 7. 1-1]  Life  testing  of  each  verification  engine  sample,  as  specified  in  Table  4-1,  shall  encompass  the 
entire  range  of  specification  (and  expected,  if  different  from  specification)  thrust,  mixture  ratio, 
propellant  inlet  boxes,  and  other  conditions  (i.e.,  life  is  not  separated  from  operation  across  the 
range  of  allowed  conditions). 

[7.7. 1-2]  Life  testing  to  a  total  duration  with  margin  over  the  SL  firing  time  shall  be  conducted  on  each  of 
the  required  verification  engine  samples  with  minimum  demonstration  factors  as  specified  in 
Table  4-1,  Life  Demonstration  Factors,  and  to  the  extent  detailed  in  Section  7.2.5,  Thrust  and 
Mixture  Ratio  Excursion  Tests. 

The  entirety  of  these  test  series  is  also  utilized  for  structural  verification  against  fatigue. 

[7. 7. 1-3]  Each  engine  sample  of  the  total  listed  in  Table  4-1  shall  be  sufficiently  instrumented  to  gather 
vibration  data  for  evaluation  of  the  dynamic  environments  relative  to  flight  conditions  and  strain 
data  for  analysis  correlation. 

[7.7. 1-4]  If  inspection  of  any  verification  engine  sample  produces  evidence  of  fatigue  damage,  the  engine 
sample  with  the  fatigue  condition  shall  be  hot-fired  for  additional  duration/starts  to  4X  service 
life,  with  intermediate  inspections  to  demonstrate  stable  damage  progression  (e.g.,  crack  growth 
remains  in  Regime  II  of  Paris  Law  fatigue  relationship). 

Any  observed  damage  also  necessitates  a  sufficient  understanding  of  the  potential  root  cause(s)  to  provide 
confidence  that  the  test  engine  is  representative  of  the  fleet.  Since  visual  inspection  may  not  be  adequate, 
an  inspection  approach  should  be  selected  that  adequately  characterizes  the  damage.  A  sufficient  number 
of  inspection  points  is  needed,  after  damage  detection,  to  ensure  damage  growth  has  stabilized. 

Acceptance  tests  are  used  to  verify  durability  and  confirm  that  production  hardware  is  in  family  with 
qualification  hardware. 

[7.7. 1-5]  LRE  acceptance  testing  shall  include  pre-  and  post-test  inspections  to  be  used  with  the  hot -fire 

data  to  verify  that  the  hardware  is  not  degrading  faster  than  rates  experienced  and  accepted  during 
qualification. 
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7.7.2  Single  Burn  Endurance  Test 


A  single -burn  endurance  test  shows  that  the  engine  does  not  have  issues  meeting  maximum  burn 
durations  as  well  as  indicating  tolerance  to  several  successive  firings  as  expressed  in  the  operational  life 
and  durability  tests. 

[7. 7.2-1]  LRE  qualification  shall  include  sustained  operation  for  a  duration  greater  than  or  equal  to  the 
maximum  expected  mission  single  burn  duration  with  margin  as  specified  in  Table  4-1  while 
using  flight  representative  profiles  in  thrust  and  mixture  ratio,  to  demonstrate  and  characterize 
run-time  trends,  and  verify  no  failure  modes  exist  that  may  require  an  extended  run  duration  to 
materialize. 

[7. 7.2-2]  For  multi-burn  applications,  LRE  qualification  tests  shall  demonstrate  margin  on  cumulative 

mission  duration  in  a  series  of  single-burn  tests.  Where  practical,  the  burns  should  be  sequential, 
with  simulated  coast  periods  between  burns.  Thermal  conditioning  may  be  simulated,  if  it  is 
impractical  to  simulate  long  coast  periods  under  space  environments,  and  the  sequence  of  coast 
events  may  be  modified,  provided  all  critical  sequences  are  tested. 

7.7.3  Nozzle  Endurance 

For  nozzles,  the  primary  concern  is  erosion  and  char  depth  margin.  Life  testing  is  used  to  verify 
acceptable  structural  interface  and  liner  interface  temperature  margins  at  the  end  of  the  extended  duration, 
including  during  the  soak-back  heating  at  shutdown. 

[7. 7. 3-1]  Life  testing  for  ablative  and  non-ablative  nozzles  shall  be  to  a  duration  above  the  worst-case 
nozzle  operational  duty  cycle,  with  at  least  one  nozzle  sample  on  each  verification  engine  with 
the  minimum  margin  specified  in  Table  4-1,  Nozzle  Operational  Demonstration  Factor. 

[7. 7. 3-2]  Post-test  dissection  inspections  of  qualification  test  nozzle  samples  shall  verify  nozzle  erosion  is 
acceptable. 

[7. 7. 3-3]  If  a  truncated  ablative  nozzle  is  to  be  used  during  acceptance  testing  to  characterize  the  injector 
environment  for  flight  units,  the  qualification  test  program  shall  establish  correlations  of  erosion 
characteristics  between  the  truncated  nozzle  versus  the  full-scale  flight  nozzle,  with  sufficient  full 
and  extended  duration  testing  to  determine  engine -to-engine  and  nozzle-to-nozzle  variability 
effects. 

[7. 7. 3-4]  Ablative  nozzle  erosion  shall  be  evaluated  for  uniformity,  following  duration  testing,  to  rule  out 
flow  protuberance  erosion  enhancement. 

[7. 7. 3-5]  While  failures  in  charred  regions  of  ablative  nozzles  may  be  acceptable,  structural  failures  shall 
be  precluded  in  non-charred  regions  unless  evaluated  to  be  not  catastrophic. 

[7. 7. 3-6]  For  engines  with  nozzle  extensions,  operational  life  testing  shall  include  a  worst  case  duty  cycle 
test  that  includes  sufficient  post-firing  duration  to  ensure  that  all  elements  of  the  structure  are 
exposed  to  temperatures  that  bound  the  flight  environment.  For  restartable  engines  with  nozzle 
extensions,  this  requirement  may  necessitate  a  test  sequence  with  simulated  coast  periods. 

[7. 7. 3-7]  Nozzle  post-test  inspection  shall  verify  no  seal  blow-by  or  seal  erosion. 
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7.7.4  Life  Starts 


Engine  starts  are  a  significant  hardware  durability  driver  and  a  major  component  to  life  calculations. 
Starting  and  stopping  the  engine  tends  to  put  significant  thermal  and  pressure  gradients  across  the  engine 
in  a  very  short  period  of  time,  stressing  hardware  significantly.  Rocket  engine  life  is  typically  quoted  in 
starts  and  seconds  (run  time).  Higher  test  margins  during  earlier  development  are  recommended  to 
provide  greater  confidence  of  success  going  into  verification  testing. 

[7. 7.4-1]  Life  testing  for  a  total  number  of  starts  with  margin  over  the  SL  starts  shall  be  conducted  on  each 
of  the  required  verification  engine  samples  with  minimum  demonstration  factors  as  specified  in 
Table  4-1,  Life  Demonstration  Lactors. 

7.7.5  Acceptance  Test  Procedure  Validation 

The  qualification  test  series  is  also  used  to  establish  the  ATP  to  be  used  for  acceptance  test  of  flight 
engines. 

[7. 7.5-1]  LRE  qualification  hot-fire  testing  shall  commence  with  the  acceptance  test  sequence  to  validate 
the  test  techniques,  processes,  procedures,  equipment,  instrumentation,  and  software  that  will  be 
used  in  production,  as  well  as  potential  allowable  rework  and  repeat  test  cycles. 

ATP  bum  times  should  be  sufficient  enough  to  screen  for  infant  mortality  issues  and  exercise  the  engine 
enough  to  ensure  that  it  is  within  qualification  family  with  sufficient  life  remaining  for  possible  stage 
ground  test  and  flight  with  margin. 

7.8  Controls 

The  engine  control  system  acts  as  the  nervous  system.  It  sends  commands  throughout  the  engine  and 
communicates  with  the  stage/vehicle.  It  also  collects  and  distributes  engine  data  as  necessary.  This 
subsystem  is  a  vital  contributor  to  the  engine  as  a  whole. 

Lunctional  tests  are  initially  conducted  off  of  the  LRE.  Control  system  malfunction  logic  checks  are 
conducted  on  the  LRE.  Vehicle  commands  and  similar  communication  may  be  simulated. 

[7.8-1]  LRE  qualification  testing  shall  verify  the  engine  control  system  can  reliably  and  accurately  satisfy 
specification  requirements  for  startup,  steady  state  operation,  throttling,  and  shutdown.  This 
verification  is  typically  satisfied  in  parallel  with  other  objectives. 

[7.8-2]  LRE  qualification  testing  shall  verify  data  collection  and  transfer  characteristics,  and  verify 

response  time  characteristics  (i.e.,  response  time  between  receipt  of  command  and  actual  physical 
response  of  fluid,  mechanical,  or  electronic  devices).  This  verification  is  typically  satisfied  in 
parallel  with  other  objectives. 

[7.8-3]  LRE  qualification  testing,  in  combination  with  controller  lab  testing  with  flight-like  interfaces, 
shall  demonstrate  fault  detection  and  accommodation  for  engine  control  system  faults  by 
verification  of  proper  identification  of  malfunctions  followed  by  acceptable  engine,  engine 
controller,  and  control  hardware  responses,  including  channel  switchover  during  the  start 
transient,  steady  state,  throttling,  and  shutdown  for  systems  with  required  redundancy. 

[7.8-4]  LRE  qualification  testing  shall  validate  that  the  engine  control  system  communicates  with  the 
vehicle,  accepts  commands,  transmits  data,  directs  engine  operational  functions  based  on 
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commands,  provides  engine  closed-loop  control  if  so  configured,  provides  condition  monitoring 
data,  and  manages  engine  health  if  also  so  configured. 

7.9  Operations 

7.9.1  Pre-Test  Inspections  and  Checkouts 

Pre-test  inspections  and  checkouts  primarily  refer  to  visual  inspections  and  functional  checks.  Checklist 
items  must  be  performed  on  both  the  facility  and  test  article  in  preparation  for  test.  These  include  items 
like  understanding  the  hardware  configuration  going  into  test,  condition  of  hardware,  removal  of 
covers/closures  where  appropriate,  review  of  h  aid  ware  changed/altered  since  previous  test,  functionality 
checks  like  cycling  the  valves,  or  end-to-end  electrical  checks  all  fall  into  this  area. 

[7. 9. 1-1]  LRE  qualification  testing  shall  validate  (and  determine,  if  not  done  during  development  testing) 
the  inspection  procedures  utilized  prior  to  test,  including,  but  not  limited  to,  visual  examination  of 
configuration,  visual  inspections  for  damage,  visual  examination  of  fits  and  clearances, 
verification  of  safety  precautions/requirements,  verification  of  facility  system  readiness,  and 
confirmation  of  adequate  consumables. 

[7.9. 1-2]  Prior  to  test  of  any  LRE,  engine -to-facility  interfaces  shall  be  inspected  to  verify  compliance  with 
dimensional  and  surface  finish  requirements. 

[7. 9. 1-3]  If  main  propellant  inlet  covers  are  removed,  the  internal  area  shall  be  inspected  to  verify  foreign 
object  debris  (FOD)-free  conditions. 

[7.9. 1-4]  Interfaces  associated  with  internal  components  sensitive  to  moisture  intrusion  shall  be  verified  to 
be  dry. 

[7.9. 1-5]  Test  preparation  shall  include  verification  that  all  test  procedures  to  be  implemented  are 

applicable  for  the  intended  test  objectives  and  are  of  the  correct  version;  that  all  facility  and 
engine  software  to  be  used  are  the  correct  versions  with  the  correct  inputs;  and  that  all  relevant 
checksums  have  been  performed. 

[7.9. 1-6]  Prior  to  test,  all  specified  functional  checkouts  shall  be  performed,  to  include  manual  or 

commanded  operation/movement  of  mechanical  systems,  electrical  integrity  verification,  control 
system  checks,  abort  system  readiness,  data  system  readiness,  and  turbopump  torque  checks  (with 
redundant  systems  functioned  separately). 

7.9.2  Post-Test  Inspections 

Inspections  after  a  test  provide  valuable  insight  that  can  help  explain  or  elaborate  on  any  unexpected  data, 
hardware  life/durability  concerns,  etc.  Depending  upon  the  test  objective,  the  set  of  inspections  conducted 
can  vary  during  the  DDT&E  program.  However,  there  will  be  a  set  of  inspections  that  will  be 
standardized  for  production  (acceptance  test)  to  validate  the  condition  of  hardware  and  show  the  engine  is 
ready  for  flight.  These  must  be  rehearsed  and  demonstrated  to  be  a  sufficient  screening  mechanism  for 
flight  preparation.  A  repeated  acceptance  test  may  also  prove  useful  to  characterize  shifts  in  performance, 
which  may  be  correlated  with  observed  physical  changes  in  the  engine. 

Post-test  inspection  requirements  for  individual  tests  are  defined  below.  In  general,  the  qualification  test 
program  should  use  the  same  requirements  intended  for  the  flight  units  during  acceptance  testing. 
Activities  in  addition  to  the  normal  activity  intended  for  flight  units  are  acceptable  if  required  for  specific 
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risk  mitigation  for  subsequent  testing.  But,  if  the  normal  activity  for  flight  units  is  found  to  be  deficient, 
then  it  must  be  improved  and  re -validated. 

[7. 9.2-1]  LRE  qualification  testing  shall  validate  (and  determine,  if  not  done  during  development  testing) 
the  inspection  procedures  and  periodic  inspection  schedules  utilized  after  test,  including  but  not 
limited  to  visual  inspections  for  damage,  visual  examination  of  fits  and  clearances,  evaluation  of 
combustion  chambers  and  nozzles  for  evidence  of  unacceptable  hot  spots  or  erosion,  and 
evaluation  of  chamber  cracks  and  leakage  against  allowables. 

[7. 9.2-2]  The  general  checkouts  identified  by  [7.9.2- 1]  shall  be  performed  after  LRE  acceptance  testing, 
engine  testing  for  operational  life,  MR  excursion  testing,  and  thrust/MR  margin  demonstration 
testing,  correlating  the  condition  of  the  engine  as  a  function  of  its  test  exposure. 

[7. 9.2-3]  After  completion  of  a  test  series  (e.g.,  all  of  the  qualification  testing  for  a  single  engine  sample), 
a  detailed  LRE  teardown  and  inspection  shall  be  conducted  in  which  disassembly  is  to  the  piece 
part  level,  and  inspections  include  examinations  for  any  signs  of  distortion,  damage,  excessive 
wear,  or  any  other  unexpected  discrepancies. 

7.9.3  Drying  and  Heated  Purges 

Drying  and  heated  purges  are  intended  to  minimize  the  moisture  (water)  in  the  system.  It  is  especially  a 
concern  with  cryogenics  and  propellants  expected  to  operate  below  the  dew  point  of  water  vapor.  Icing  of 
sense  lines  during  engine  hot-fire  may  block  pressure  measurements  or  affect  feedback  control;  icing  of 
injector  elements  may  cause  local  maldistribution  of  propellants.  Exposure  to  residual  moisture  may  also 
cause  material  swelling  (e.g.,  in  seals)  or  stress  corrosion  cracking  (e.g.,  in  bearings).  The  elevated 
temperature  used  in  purges  must  consider  the  material  properties  used  within  the  system. 

[7. 9. 3-1]  LRE  qualification  testing  shall  validate  (and  determine,  if  not  done  during  development  testing) 
the  purge  flow  and  drying  procedures  to  maintain  or  return  engines  to  specification  limits, 
including  checks  of  dew  point  at  purge  exit  points  at  designated  times. 

[7. 9. 3-2]  Acceptable  hardware  conditions  after  purges  shall  be  verified  by  post-test  inspections  and/or 
subsequent  successful  hot-fire. 

7.9.4  Gas  Liquefaction  Control 

This  testing  refers  to  liquid  air  formation  and  control  of  detrimental  amounts  generated  by  cryogenic 
systems.  Typically,  foam  insulation  techniques  are  used  for  vacuum  jackets.  However,  liquid  air  can  still 
form  in  areas  which  can  cause  dripping  onto  electrical  components,  cryo-pumping,  and  insulation 
damage.  The  control  and  mitigation  methods  need  testing  to  demonstrate  durability,  repair  techniques, 
etc. 

[7. 9.4-1]  LRE  testing  shall  demonstrate  on  a  minimum  of  two  engines,  the  life  and  durability 

characteristics  to  prove  out  application  processes  and  design  sensitivities  of  insulation  techniques 
(including  the  effectiveness  of  repair  processes)  for  cryogenic  systems  in  regard  to  gas 
liquefaction. 

7.9.5  External  Icing 

Ice  formation  on  the  external  surface  of  the  hardware  can  act  like  an  insulator  or  vibration  dampener. 
Environmental  testing  should  simulate  vehicle  environments  to  mimic  the  atmospheric  moisture 
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conditions,  pre-start  conditioning,  etc.  On  the  J-2,  for  example,  ice  formed  on  the  augmented  spark  igniter 
line  and  acted  as  a  dampener  for  ground  test.  When  in  flight,  the  ice  did  not  form,  and  the  line  ruptured 
due  to  vibration.  (Source:  JANNAF-GL-2012-01-R0  [17]) 

[7. 9.5-1]  LRE  testing  shall  characterize  external  icing  during  qualification  testing  and  identify  any 
potential  ground-to-flight  differences. 

[7. 9.5-2]  The  insights  gained  from  [7.9.5- 1]  shall  be  used  to  interpret  the  validity  of  the  verification  engine 
test  data  for  flight,  and  determine  if  additional  testing/analysis  is  required  to  ensure  that  the 
insulating  or  dampening  characteristics  of  external  icing  are  well  characterized  from  ground-to- 
flight,  and  their  effects  are  understood  and  acceptable  for  flight. 

7.9.6  LRU  Demonstrations 

LRUs  are  components  that  are  interchangeable  and  do  not  pose  a  threat  to  the  understood  performance  of 
the  engine.  Typically  an  LRU  is  a  component  that,  when  removed  and  replaced  within  an  LRE,  either  has 
a  trivial  effect  on  LRE  performance  and  reliability,  or  a  known,  well-characterized,  and  predictable  effect 
on  LRE  performance  and  reliability.  Example  LRUs  are  igniters  and  isolation  valves.  An  LRU  can  be 
changed  after  final  LRE  acceptance  testing  without  requiring  that  LRE  to  repeat  the  hot-fire  test.  With 
few  exceptions,  however,  the  LRU  itself  must  have  undergone  acceptance  hot-fire  testing  on  another  LRE 
(see  [6.1-1]).  A  long  list  of  components  allowed  as  LRUs  helps  provide  flexibility  in  maintaining  engine 
delivery  schedules  when  a  concern  is  raised  about  a  particular  component  installed  on  an  LRE  that  has 
already  completed  acceptance  testing.  Appropriate  cost  versus  benefits  trades  should  be  performed  to  help 
define  the  intended  list  of  “authorized”  LRUs. 

[7. 9.6-1]  The  LRE  qualification  shall  validate  each  “authorized”  LRU  and  its  replacement  procedures, 

including  comparisons  of  resultant  performance  variation  due  to  unit  replacement  versus  relevant 
performance  uncertainty  requirements,  via  direct  and  individual  replacement  of  each  LRU  while 
minimizing  any  other  test-to-test  changes  that  might  affect  performance. 

7.9.7  Reusability 

Reusability  of  an  LRE  adds  unique  requirements. 

[7. 9.7-1]  The  LRE  qualification  shall  demonstrate  two  sets  of  two  complete  mission  flight  sequence 
simulations,  with  the  first  set  at  a  nominal  turnaround  time  and  the  second  set  at  a  minimum 
turnaround  time  by  inclusion  of  the  following: 

a.  demonstration  of  engine  system  start,  steady  state  operation,  and  shutdown 
over  a  complete  flight  sequence  simulation  during  engine  operation; 

b.  testing  to  simulate  fly-back/return  environments/loads  exposure,  if  applicable; 

c.  verification  of  turnaround  capability  using  specific  procedures  for  the  engine 
and  countdown; 

d.  demonstration  of  any  required  between-flight  hardware  or  software 
modifications; 

e.  inclusion  of  standard  post-flight  checkout  and  inspections,  required  health 
monitoring  data  reviews,  and  pre-flight  checkout  using  the  same  access 
limitations  and  restrictions,  including  limitations  on  vertical  and  horizontal 
access,  as  applicable,  and  confined  spaces; 
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f.  demonstration  of  engine  system  re-start,  steady  state  operation,  and  shutdown 
over  a  repeated  complete  flight  sequence  simulation  during  engine  operation; 
and 

g.  final  post-flight  checkout  and  inspections,  required  health  monitoring  and  data 
reviews  to  verify  the  LRE  successfully  meets  all  criteria. 

7.9.8  Operability 

The  term  operability  is  utilized  to  describe  the  ability  to  conduct  operational  procedures  in  a  timely  and 
effective  manner,  such  as  minimizing  the  level  of  effort  required  to  change  LRUs  when  necessary, 
conduct  pre-  and  post-  test  checkouts,  and  conduct  electrical  and  mechanical  checkouts.  This  also 
manifests  itself  in  operational  timeline  optimizations.  Test  demonstrations  help  determine  the  allowed 
time  to  perform  the  multitude  of  operational  tasks  on  an  engine. 

[7. 9. 8-1]  LRE  qualification  testing  shall  determine  and  verify  practical  servicing  procedures,  operational 
readiness  capabilities,  maintenance  access  requirements,  and  availability  and  suitability  of 
alternate  parts/processes. 

Access  to  the  propulsion  system  for  verification  should  be  similar  to  actual  flight-related  operations  and 
replicate  the  engine  servicing  environment  expected  during  full  operational  status.  Engine-related 
operability  verification  should  be  performed  according  to  the  intended  engine  servicing  configuration 
(e.g.,  mounted  on  the  flight  vehicle,  or  removed  and  replaced)  and  orientation  (e.g.,  vertical  or  horizontal) 
during  flight-related  operations.  Operability  verification  demonstrations  should  include  or  replicate 
vehicle  elements,  and  use  available  resources,  including  on-ground  maintenance  equipment  and  logistics 
support  infrastructure,  as  close  as  possible  to  the  intended  standard  launch  operations. 

7.9.9  Preflight  Procedures  and  Flight  Sequences 

This  includes  the  pre-flight  countdowns  and  hardware  preparation  and  configuration  for  flight.  Much  of 
the  vehicle  operations  are  remotely  operated  at  this  point.  However,  there  may  be  some  flight  day  or  near 
flight  day  activities  that  would  require  personnel  around  the  engine  or  vehicle. 

Because  DDT&E  tends  to  occur  a  significant  time  before  first  flight,  the  procedures  known  at  that  point 
are  likely  significantly  lower  fidelity  than  what  will  be  used  on  flight  day.  However,  notional  procedures 
can  be  put  in  place  based  on  known  vehicle  architecture  and  concept  of  operations.  Interfaces  with  vehicle 
simulated  command  and  data  systems  should  be  part  of  the  facility  configuration. 

[7. 9.9-1]  LRE  qualification  testing  shall  demonstrate  preflight  procedures  and  operational  procedures, 
followed  by  verification  of  acceptable  operation  during  a  simulation  of  the  flight  sequence  of 
events.  Where  practical,  the  burns  (if  more  than  one)  should  be  sequential,  with  simulated  coast 
periods  between  burns.  Thermal  conditioning  may  be  simulated,  if  it  is  impractical  to  simulate 
long  coast  periods  under  space  environments,  and  the  sequence  of  coast  events  may  be  modified, 
provided  all  critical  sequences  are  tested. 

7.10  Process  Controls 

7.10.1  Manufacturing 

Since  manufacturing  processes  are  also  being  qualified,  the  test  program  must  identify  expectations 
regarding  hardware  discrepancies  and  how  they  can  play  into  hardware  durability,  data  from  testing,  etc. 
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This  is  an  important  part  of  the  DDT&E  effort  as  it  is  likely  to  see  several  manufacturing  issues  of 

varying  criticality  during  development  due  to  low  production  levels. 

[7.10.1-1]  Key  (design)  characteristics  (KCs)  and  their  associated  critical  manufacturing  processes  (CMPs) 
shall  be  identified  and  qualified. 

[7.10.1-2]  Key  process  parameters  (KPPs)  for  each  CMP  (including  repair  procedures)  shall  be  identified, 
documented,  and  strictly  controlled  (for  example,  these  would  include  laser  speed,  laser  power, 
and  powder  specification  for  additively-manufactured  parts). 

[7.10.1-3]  In-process  inspection  or  process  monitoring  shall  be  used  to  verify  the  setup  and  acceptability  of 
critical  parameters  during  the  fabrication  process/procedure,  especially  for  additive  manufactured 
parts. 

[7.10.1-4]  Traceability  shall  be  maintained  on  all  fracture -critical  structural  items  throughout  their 
development,  manufacturing,  testing,  and  service. 

[7.10.1-5]  Inspection  reports  which  include  type  of  NDI  and  sensitivity  level,  material  and  condition,  and 
part  number  shall  be  maintained  throughout  the  life  of  the  program,  and  periodically  reviewed 
and  assessed  to  evaluate  trends  and  anomalies  associated  with  the  inspection  procedures. 

[7.10.1-6]  Volumetric  NDI  shall  be  required  for  welds,  cast  parts,  and  for  parts  susceptible  to  internal 
flaws  resulting  from  manufacturing. 

[7.10.1-7]  LRE  testing  shall  identify  and  track  hardware  or  operational  discrepancies,  anomalies,  or 

deficiencies  including  but  not  limited  to  cracks,  material  erosion/  discoloration,  part  deformation, 
unexplained  elevated  vibration,  and  unusual  operating  characteristics. 

7.10.2  Mass  Properties 

Engine  weight,  center  of  gravity,  and  moments  of  inertia  must  be  understood  and  translated  to  vehicle 

controls  and  trajectory  analysts. 

[7.10.2-1]  Each  LRE  shall  be  weighed  in  the  as-tested  configuration  as  part  of  the  engine  test  program  to 
allow  calculation  of  the  center  of  gravity  and  moments  of  inertia. 

7.11  Unique  Requirements 

7.11.1  New  or  Mission  Unique  Requirements 

[7.11.1-1]  New  requirements  or  mission  unique  requirements  levied  on  the  LRE  following  completion  of 
qualification  shall  require  a  combination  of  evaluation  and  test  (including  the  option  of  not 
requiring  delta-qualification)  to  qualify  the  engine  for  the  new  requirements,  with  concurrence  of 
the  Approval  Authority. 

7.11.2  Delta-Qualification  Requirements 

Qualification  testing  should  be  performed  on  the  final  design,  manufacturing  processes,  procedures,  and 

acceptance  program  to  be  used  for  flight  units. 

[7.11.2-1]  Deviations  following  completion  of  LRE  qualification  shall  require  that  the  system  be  re¬ 
qualified  (i.e.,  “delta-qualification”)  via  combination  of  evaluation  and  test  (including  the  option 
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of  not  requiring  delta-qualification),  with  concurrence  of  the  Approval  Authority,  where 
deviations  include  configuration  changes,  modified  processes,  new  suppliers,  new  facilities,  or 
revised  procedures. 
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8.  System  Requirements 


One  or  more  LREs  will  be  integrated  into  a  launch  vehicle  stage,  and  the  stages  are  integrated  into  the 
complete  launch  vehicle.  SMC-S-016  [1]  terms  the  complete  launch  vehicle  as  a  system. 

8.1  Stage  and  System  Test 

Stage-level  testing  verifies  engine  operation  within  an  integrated  flight-like  system.  Such  testing  is  a 
specific  instance  of  an  end-to-end  performance  test  necessary  to  verify  the  engine  and  associated 
subsystems.  Unlike  other  end-to-end  performance  tests  identified  in  SMC-S-016  [1],  it  does  not  need  to 
be  repeated  prior  to,  during,  or  after  environmental  testing.  However  the  operating  conditions, 
environment,  and  command  sequence  should  be  carefully  selected  to  verify  the  system  interactions  in 
flight  like  conditions. 

[8.1-1]  Engine  qualification  shah  include  an  engine-integrated  stage  test  to  verify  system  interactions  and 
control  during  engine  prestart,  start,  dwell,  and  shutdown,  including,  for  engine  cluster  type  stage 
configurations,  stage  functional  and  performance  demonstration  of  the  design-maximum  engine 
out  capability. 

[8.1-2]  For  multiple  engine  (cluster)  vehicle  configurations,  integrated  testing  or  relevant  analysis  shall  be 
completed  to  ensure  engine  interactions  are  acceptable. 

[8.1-3]  Qualification  testing  of  TVC  and  deployment  mechanisms  shall  verify  through  real  time 

observation  and  post-test  inspection  that  all  thermal  protection  shields,  flexible  boots,  gimbal 
hardware  and  adjacent  structures  remain  properly  configured/intact  through  ah  physical 
movement. 

8.2  Pre-Launch  Validation  and  Operational  Tests 

General  prelaunch  requirements  are  defined  in  SMC-S-016  [1].  The  scope  of  these  tests  covers  from 
receiving  a  stage  at  the  launch  site  to  launch.  Additional  requirements  are  noted  in  the  following  sections. 

8.2.1  General  Requirements 

[8. 2. 1-1]  The  LRE  shall  comply  with  SMC-S-016  [1]  requirements  for  Prelaunch  Validation  and 
Operational  Tests  paragraphs  9.1,  9.2,  9.3,  and  9.4. 

8.2.2  Receiving  Inspection 

[8. 2.2-1]  An  external  inspection  of  the  condition  of  hardware  shall  be  conducted  to  include  the  following: 

a.  All  discrepancies  noted  and  dispositioned. 

b.  State  of  all  desiccants,  covers,  closures,  acceleration  monitors,  and  support 
equipment/cradles/etc.,  that  “touch”  flight  articles,  with  the  focus  on  understanding  if  the 
condition  of  the  hardware  has  changed  as  a  result  of  transportation  and  handling. 

c.  If  main  propellant  inlets  covers  are  removed,  verification  of  FOD-free  conditions  on  the 
internal  area. 
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8.2.3  Purges 


Purges  are  often  necessary  to  maintain  the  engine  internal  environment  (desired  cleanliness  and  moisture 
levels)  whenever  any  protective  covers  and  closures  have  been  removed.  While  performing  final  vehicle 
assembly  and  maintenance  in  a  semi-controlled  environment,  limited  periods  of  exposure  (without 
purges)  may  be  allowed.  However,  to  ensure  the  propulsion  system  internal  environment  remains 
acceptable,  a  sequencing  of  purges  and  moisture  checks  should  follow  to  validate  the  internal 
environment.  In  preparation  for  launch,  including  tanking  and  loading  of  propellants  and  pressurants, 
purges  are  necessary  on  a  more  continuous  basis  to  provide  the  confidence  that  the  hardware  internal 
environment  is  maintained.  Purge  sequences  are  usually  automated,  and  rules  for  moving  from  one 
sequence  to  another  (forward  or  backward)  are  well  established  and  software  controlled. 

[8. 2.3-1]  Purge  operations  shall  be  validated  against  requirements  (see  [7. 9. 3-1])  by  verification  of 
pressures,  temperatures,  flow  rates,  and  fluid  quality  (grade,  moisture  content,  etc.). 

8.2.4  Vehicle  Readiness  Test 

The  vehicle  readiness  test  is  intended  to  verify  readiness  of  the  assembled  vehicle  by  performing  a 
simulated  flight  sequence  using  control  parameters  at  nominal  operating  values. 

[8. 2.4-1]  Engine  control  system  functional  checks  shall  be  performed  through  the  airborne  flight  control 
system  with  control  parameters  at  nominal  value  per  the  flight  sequence. 

[8.2.4-2]  Engine  control  system  functional  checks  shall  verify  through  real-time  observation  and  post-test 
inspection  that  all  thermal  protection  shields,  flexible  boots,  girnbal  hardware,  flexible  ducting, 
lines,  cabling,  and  adjacent  structures  function  as  intended,  and  remain  properly 
configured/intact,  through  all  physical  movement. 

[8. 2.4-3]  Vehicle  readiness  testing  of  TVC  and  deployment  mechanisms  shall  validate  the  engine  envelope 
clearance  analyses  at  TVC  limit  positions.  Dry,  ambient  hardware  conditions  can  be  used  for  this 
test. 

[8. 2.4-4]  Vehicle  readiness  testing  of  TVC  and  deployment  mechanisms  shall  verify  girnbal  block  and  roll 
control  (if  applicable)  interface  compatibility  for  mechanical  (e.g.,  bearings),  hydraulic,  and 
electrical  connections  under  nominal  control  parameters. 

8.2.5  Vehicle  Tanking  Test 

This  test  is  intended  to  verify  readiness  of  the  assembled  vehicle  and  interfacing  ground  support 
equipment.  This  test  is  intended  to  go  as  far  into  the  pre-launch  countdown  procedures  as  feasible, 
including  loading  of  propellants,  without  igniting  the  propulsion  systems.  The  test  is  not  intended  for 
hyper golic  propellants. 

For  engine  architectures  involving  Earth  storable  hypergolic  propellants,  it  is  desirable  to  not  load  and 
subsequently  unload  hypergolic  propellants  in  the  associated  flight  propulsion  system  under  nominal 
operating  conditions.  As  such,  the  identified  guideline  for  a  vehicle  tanking  test  is  not  recommended  for 
systems  utilizing  these  storable  hypergolic  propellants.  This  avoids  or  reduces  the  potential  for 
inadvertent  air/ground  atmosphere  and  propellant  reactions,  as  well  as  propellant  reaction  product 
precipitate  issues  within  the  flight  propulsion  system. 
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[8. 2.5-1]  Preflight  procedures  and  launch  timelines  shall  be  demonstrated  by  the  vehicle  tanking  test. 
Operational  procedures  should  be  used  to  the  extent  possible. 


[8. 2.5-2]  The  vehicle  tanking  test  shall  include  use  of  the  preflight  sequence,  including  any  functional 
health  checks  such  as  TVC  and  valve  slewing,  and  engine  controller  checkout. 

[8. 2.5-3]  The  vehicle  tanking  test  shall  exercise  thermal  conditioning  processes  and  procedures,  and  verify 
performance  of  engine  system  passive  and  active  thermal  control  (including  chilldown,  warming 
purges,  heaters,  etc.). 

[8. 2.5-4]  The  vehicle  tanking  test  shall  verify  engine  SCC  can  be  satisfied  prior  to  commit  time. 

[8.2.5-5]  The  vehicle  tanking  test  shall  demonstrate  the  TVC  operational  envelope  prior  to  introducing 
propellants,  as  well  as  after  propellant  load  and  engine  thermal  conditioning. 

[8. 2.5-6]  Following  the  vehicle  tanking  test,  post-test  inspections  shall  be  performed  to  verify  that  the 
hardware  resulting  condition  is  satisfactory  and  ready  for  flight. 

8.2.6  Prelaunch  Countdown 


The  same  steps  utilized  in  the  Vehicle  Tanking  Test  are  conducted  leading  up  to  actual  launch  (except  for 
post-test  inspections  [8.2.5-6J).  Additional  checks  may  be  included  to  verify  propulsion  system  health 
immediately  prior  to  liftoff.  Primarily,  this  consists  of  review  of  the  LCC  and  detailed  operating 
procedure  (DOP)  prior  to  executing  the  launch  command.  No  failure  identifications  (FIDs)  should  be  left 
without  disposition.  Hardware  must  be  thermally  conditioned  and  in  proper  configuration  for  launch. 
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Appendix  A.  Tailoring  Guidance 


The  values  in  Table  4-1  are  derived  from  experience  and  reliability  analysis,  and  are  consistent  with 
JANNAF-GL-2012-01-R0  [17].  The  total  unique  verification  engine  samples  listed  (4)  are  to  have 
similarity  with  the  flight  design,  but  may  be  considered  development,  qualification,  or  even  flight  units. 
Each  engine  may  have  different  test  objectives  associated  with  it,  provided  the  specific  variation  does  not 
compromise  any  other  objectives,  thus  allowing  some  leeway  with  regards  to  hardware  configuration.  The 
intent  is  to  achieve  a  sample  size  large  enough  to  begin  to  establish  build-to -build  variation  with  a 
quantifiable  level  of  confidence.  The  total  number  is  supported  by  Weibull  reliability  analysis,  and  has 
been  successfully  utilized  previously. 

Careful  consideration  should  be  given  to  hardware  configuration,  and  what  is  considered  to  be  a  valid 
sample.  Hardware  changes  (due  to  a  failure,  intended  improvements,  convenience,  or  any  other  reason) 
generally  invalidate  earlier  samples  for  the  components  changed,  as  well  as  for  all  other  interrelated 
engine  components,  unless  it  can  be  confidently  demonstrated  that  the  changes  had  a  benign  effect  on 
their  environments  and  interactions.  Combinations  of  component  level  and  system  level  testing  should 
also  be  considered  when  determining  sample  sizes  at  the  engine  level. 

Furthermore,  the  engine  design  should  be  evaluated  relative  to  design  heritage.  The  appropriateness  of  the 
four  samples  can  be  significantly  influenced  by  heritage,  evolutionary,  or  clean  sheet  designs.  However, 
there  are  many  examples  where  seemingly  “small  changes”  have  had  significant  adverse  unintentional 
and  unexpected  consequences,  so  careful  consideration  must  be  taken  on  how  to  apply  any  heritage  data 
to  reduce  the  sample  population.  The  following  sections  discuss  examples  where  the  test  numbers  and 
factors  have  been  modified,  as  shown  in  Table  A-l  (versus  Table  4-1).  Justification  and  implications  to 
realized  risk  levels,  which  are  different  from  the  standard  recommendation,  are  provided  for  each  case. 

Table  A-l.  Example  Alternate  LRE  Verification  Engine  Samples  and  Margins/Demonstration  Factors, 

Which  Have  Different  Associated  Risk  Levels  Than  with  the  Standard  Recommendation 


Parameter 

A.1 

A.2 

A.3* 

Engine  Samples 

Minimum  Total  Engine  Samples,  4.3.1 

6 

4 

2 

Minimum  Qualification  Engine  Samples,  4.3.1 

2 

2 

1 

Unit  &  Subscale  Test  and  Evaluation 

Unit  Life  Margin  Factor,  6.13.1 , 6.13.3 

4x 

4x 

2x 

LRE  Test  and  Evaluation 

Thrust  /  MR  Margin  Factor,  7.2.6 

2% 

2% 

2% 

Life  Demonstration  Factors,  7.7.1, 7.7.4 

2x  on  6 

4x  on  1 , 

2x  on  1, 
lx  on  2 

2x  on  2 

*  Note  that  this  option  is  for  a  pressure -fed  engine,  i.e.,  a  simpler  design. 


As  noted  previously,  the  recommended  minimum  of  four  verification  engine  samples  (Table  4-1)  are 
based,  in  part,  on  Weibull  reliability  analysis.  Weibull  reliability  functions  (50%  confidence  bounds, 
using  rank  regression)  are  shown  in  Figure  A-l,  for  this  sample  size  requirement,  with  no  failures.  The 
value  of  beta  represents  the  type  of  failure  mode,  and  is  manifested  as  the  slope  of  the  line  on  a  Weibull 
plot.  The  high  beta  (high  slope)  failure  modes  (which  represent  wear-out  failure  modes),  are  most 
impacted  by  the  4xSL  engine  sample.  The  low  beta  (low  slope)  failure  modes  (which  represent  infant 
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mortality  and  random  failure  modes),  are  most  impacted  by  the  three  2xSL  engine  samples.  That  said,  the 
predicted  failure  rate  for  all  the  betas  analyzed  is  not  favorably  small.  For  example,  the  analysis  (with 
50%  confidence  bound)  predicts  10%  of  engines  will  fail  by  the  end  of  1  service  life  (lxSL)  for  beta  =  0.5 
(infant  mortality  failure  modes),  and  7%  of  engines  will  fail  at  lxSL  for  beta  =  1  (random  failure  modes). 
This  baseline  case  emphasizes  the  fact  that  engine  qualification  testing  is  not  the  only  factor  that 
determines  overall  engine  reliability.  Robust  material  screening/quality  control  processes,  and  acceptance 
testing,  is  absolutely  required  for  high  reliability.  Further,  high  reliability  (particularly  for  infant  mortality 
and  random  failure  modes)  requires  much  more  cumulative  engine  test  experience  than  4  engines.  For 
beta  =  3  (early  wear-out  modes)  and  beta  =  6  (later  wear-out  modes),  the  4xSL  engine  qualification 
sample  has  a  very  significant  impact  on  reliability,  with  0.8%  and  0.02%  of  engines  failing  at  1  service 
life  (50%  confidence  bound).  Robust  designs  and  defect  screening  procedures  will  also  help  improve 
reliability,  as  will  unit-level  component  testing  to  4xSL. 
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Multiple  (Service  Lives) 

Figure  A-l.  Weibull  analysis  of  a  qualification  program  with  one  engine 
sample  taken  to  4xSL,  and  three  engines  samples  taken  to  2xSL,  with  no  failures. 


A.1  More  Engines  Tested,  But  Lower  Qualification  Demonstration  Factor 

If,  rather  than  testing  four  verification  engines  per  Table  4-1  (1  to  4xSL,  and  3  to  2xSL),  instead  six 
engines  are  tested  to  2xSL  each,  the  Weibull  analysis  at  a  50%  confidence  bound  will  change,  as  shown  in 
Figure  A-2  for  comparison.  Note  that  the  reliabilities  at  1  service  life  for  beta  =  0.5  (infant  mortality 
failure  modes)  and  beta  =  1  (random  failure  modes)  are  improved  over  the  requirement  in  Table  4-1 .  That 
is  because  this  tailoring  results  in  more  cumulative  engine  experience  (6  engines  at  2xSL/engine  =  12xSL 
total  engine  experience,  as  opposed  to  1  engine  at  4xSL  +  3  engines  at  2xSL/engine  =  lOxSL  total  engine 
experience).  However,  the  failure  rates  for  beta  =  3  and  6  (wear  out  failure  modes)  went  up  significantly, 
in  comparison.  That  predicted  rise  in  failure  rate  would  need  to  be  offset  by  other  factors,  such  as 
improved  unit  level  testing  and/or  improved  fidelity  in  the  analytical  predictive  capability  for  those  failure 
modes.  However,  analysis  is  typically  quite  challenged  to  confidently  address  the  wear-out  failure  modes 
associated  with  fatigue  of  complex  turbomachinery  typical  of  LREs,  and  unit  acceptance  testing  typically 
is  inadequate  to  screen  fatigue  issues. 
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Figure  A-2.  Weibull  analysis  of  a  qualification  program  with  six  engine  samples  taken  to  2xSL  (no  failures). 


A.2  Accepting  Increased  Risk 

If,  rather  than  testing  four  verification  engines  per  Table  4-1  (1  to  4xSL,  and  3  to  2xSL),  instead  one 
engine  is  tested  to  4xSL,  one  engine  is  tested  to  2xSL,  and  two  engines  are  tested  to  lxSL  each,  the 
Weibull  analysis  at  a  50%  confidence  bound  will  change,  as  shown  in  Figure  A-3  for  comparison.  The 
reliability  at  1  service  life  for  beta  =  6  (late  wear  out  failure  modes)  is  essentially  driven  by  the  4xSL 
qualification  engine,  and  is  unchanged.  The  reliabilities  for  the  other  failure  modes  are  slightly  degraded, 
now  with  only  8xSL  cumulative  engine  test  experience.  A  program  may  be  willing  to  accept  higher  initial 
risk  for  some  failure  modes  coming  out  of  qualification,  recognizing  that  future  risk  for  some  modes  may 
improve  as  greater  test  and  flight  experience  is  gained.  If  flight  engines  are  utilized  as  samples,  additional 
flight  instrumentation  may  be  required  to  help  demonstrate  that  no  failure  modes  had  been  experienced. 
However,  it  may  not  be  possible  to  adequately  verify  post-firing  health  of  those  engines  (particularly 
imminent  failures),  unless  the  engines  are  brought  back  and  inspected. 
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Figure  A-3.  Weibull  analysis  of  a  qualification  program  with  one  engine  sample  taken  to  4xSL, 
one  engine  sample  taken  to  2xSL,  and  two  engine  samples  taken  to  lxSL  (no  failures). 
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A.3  Pressure  Fed  Engine  Design 

The  simplest  LRE  designs,  such  as  pressure-fed  engines,  may  more  readily  be  able  to  use  reduced  engine 
samples  without  drastic  increase  in  risk.  The  justification  for  the  reduction  is  because  pressure-fed 
engines  have  far  less  significant  system  interactions  than  pump-fed  engines,  and  the  load  environment  is 
more  predictable.  A  minimum  of  two  verification  engine  samples,  including  one  qualification  engine, 
may  be  appropriate  for  a  new  pressure-fed  engine  design.  Size-scaling  of  existing  engine  designs  should 
be  considered  as  equivalent  to  a  new  engine  design  for  many  objectives.  For  comparison,  Figure  A-4 
shows  predicted  reliability  (50%  confidence  bound)  for  two  verification  engines  tested  to  2xSL. 
Reliability  is  significantly  degraded,  based  upon  the  test  engines  alone,  in  comparison  with  the 
requirement  outlined  in  Table  4-1,  so  high  fidelity  analysis  with  robust  margins,  robust  material 
screening/quality  control  processes,  reliable  acceptance  testing,  etc.  is  absolutely  essential  for  high  flight 
reliability. 
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Figure  A-4.  Weibull  analysis  of  a  qualification  program  with  two  engine  samples  taken  to  2xSL  (no  failures). 
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